Documentation

1. Purpose

This guide describes how to configure the CBOM Discover_PKI sensor to connect read-only to a Microsoft Active Directory Certificate Services (AD CS) Certificate Authority (CA). The sensor discovers all issued certificates stored in the CA database, including metadata such as serial numbers, expiration dates, subject identities, and key usage extensions.

Cryptographic material discovered:

Issued X.509 certificates (Disposition = 20)
Certificate serial numbers and validity periods
Subject distinguished names and email addresses
Key algorithm, key size, and signature algorithm
Certificate templates and intended purposes (EKU extensions)
Revocation status and CRL distribution points

This guide covers creating a dedicated Windows service account, granting the minimum required permissions on the CA, verifying connectivity using certutil, and configuring the CBOM sensor YAML.

2. Prerequisites

Before starting, ensure the following are in place:

You have access to a Windows Server running Active Directory Certificate Services with the Certification Authority role service installed.
You have Domain Admin or Enterprise Admin privileges, or delegated rights to create service accounts in Active Directory and modify CA security settings.
The CA is reachable from the CBOM sensor host over DCOM/RPC (TCP 135 + dynamic high ports) or via the certutil command-line tool.
The CBOM sensor host has the Windows Remote Server Administration Tools (RSAT) installed, or certutil.exe is available in the PATH.
The CA Common Name and Server hostname are known (for example, CASERVER01\MyEnterpriseCA).
PowerShell 5.1 or later is available on the host used for service account creation.
The CBOM agent is installed and the Discover_PKI sensor module is present.

3. Create a Dedicated Service Account in Active Directory

A dedicated, least-privilege Windows service account is required. This account will be granted read-only access to the CA database and will never be used for interactive logon.

3.1 Create the Service Account

Open Active Directory Users and Computers (dsa.msc) on a domain controller or a management workstation with RSAT installed.
Navigate to the organizational unit (OU) where service accounts are stored. If no dedicated OU exists, create one:
```
New-ADOrganizationalUnit -Name "ServiceAccounts" -Path "DC=contoso,DC=com"
```

Create the new service account using PowerShell:

New-ADUser `
  -Name "svc-cbom-pki" `
  -SamAccountName "svc-cbom-pki" `
  -UserPrincipalName "[email protected]" `
  -Path "OU=ServiceAccounts,DC=contoso,DC=com" `
  -AccountPassword (ConvertTo-SecureString "P@ssw0rd_ChangeMe!" -AsPlainText -Force) `
  -PasswordNeverExpires $true `
  -CannotChangePassword $true `
  -Enabled $true `
  -Description "CBOM PKI Sensor read-only service account"

Confirm the account was created successfully:

Get-ADUser -Identity "svc-cbom-pki" | Select-Object Name, SamAccountName, Enabled

3.2 Restrict Logon Rights (Hardening)

Open Group Policy Management (gpmc.msc) and edit or create a GPO linked to the ServiceAccounts OU.

Navigate to:

Computer Configuration > Windows Settings > Security Settings >
Local Policies > User Rights Assignment

Add svc-cbom-pki to Deny log on locally and Deny log on through Remote Desktop Services to prevent interactive use.
Apply the GPO:
```
gpupdate /force
```

4. Grant Read-Only Access to the Certificate Authority

The service account must be granted permission to enumerate and read issued certificates from the CA database. This is achieved by modifying the CA security descriptor. Do not grant Issue and Manage Certificates write access.

4.1 Grant Read Permission via certsrv.msc (GUI Method)

On the CA server, open the Certification Authority MMC snap-in:
```
certsrv.msc
```
In the left pane, right-click the CA name and select Properties.
Click the Security tab.
Click Add, then search for and select svc-cbom-pki.
Under Permissions for svc-cbom-pki, check Allow for the following permissions only: - Read — allows reading CA configuration and certificate records
Ensure Issue and Manage Certificates is set to Deny or left unchecked. Click OK and Apply.

4.2 Grant Read Permission via certutil (CLI Method)

On the CA server, open an elevated command prompt and run:
```
certutil -setreg CA\Security "+CIADMIN:svc-cbom-pki:Read"
```
Alternatively, use the full Security Descriptor Definition Language (SDDL) approach to grant the read ACE:
```
certutil -config "CASERVER01\MyEnterpriseCA" -setreg CA\Security ^
  "+CIADMIN:CONTOSO\svc-cbom-pki:Read"
```
Restart the Active Directory Certificate Services service for the permission change to take effect:
```
net stop certsvc && net start certsvc
```

4.3 Verify Effective Permissions

From the CA server or a machine with certutil and network access, verify the service account can read the CA security descriptor:
```
certutil -config "CASERVER01\MyEnterpriseCA" -getreg CA\Security
```
Confirm svc-cbom-pki appears in the output with Read access and that no write or management rights are listed.

5. Verify CA Connectivity and Certificate Enumeration

Before configuring the CBOM sensor, confirm that the service account can successfully query issued certificates using certutil.

5.1 Test Certificate Enumeration

On the CBOM sensor host (logged in as or impersonating svc-cbom-pki), run the following command to list issued certificates (Disposition 20 = Issued):
```
certutil -view -config "CASERVER01\MyEnterpriseCA" ^
  -restrict "Disposition=20" ^
  -out "SerialNumber,NotAfter,SubjectEmail"
```

The output should display a table of issued certificates with their serial numbers, expiration dates, and subject email addresses. Example output:

SerialNumber: 1a2b3c4d5e6f7a8b
NotAfter: 12/31/2026 12:00 AM
SubjectEmail: [email protected]

SerialNumber: 9f8e7d6c5b4a3210
NotAfter: 06/15/2025 12:00 AM
SubjectEmail: [email protected]

If the command returns results, connectivity and permissions are confirmed. If access is denied, revisit Section 4.

5.2 Test with a Restricted Query

Run a query scoped to certificates expiring within the next 90 days to validate filter support:

certutil -view -config "CASERVER01\MyEnterpriseCA" ^
  -restrict "Disposition=20" ^
  -out "SerialNumber,NotAfter,SubjectDN,CertificateTemplate"

Confirm results are returned without errors before proceeding to sensor configuration.

6. Configure CBOM Sensor

Create or update the CBOM sensor configuration file for the Discover_PKI sensor. Place this file in the CBOM agent configuration directory (for example, /etc/cbom/sensors/ on Linux or C:\CBOM\sensors\ on Windows).

# /etc/cbom/sensors/adcs-pki-sensor.yaml
# CBOM Discover_PKI Sensor — Microsoft AD CS

sensor:
  name: Discover_PKI
  enabled: true
  description: "Read-only discovery of issued certificates from Microsoft AD CS"

connection:
  type: adcs
  ca_config: "CASERVER01\\MyEnterpriseCA"   # Server\CAName format
  host: "CASERVER01.contoso.com"
  port: 135                                  # DCOM endpoint mapper
  transport: rpc_dcom

authentication:
  method: windows_service_account
  domain: "CONTOSO"
  username: "svc-cbom-pki"
  # Store credentials in the CBOM secrets vault, not plaintext:
  password_secret_ref: "cbom-vault://adcs/svc-cbom-pki"

discovery:
  scope: issued_certificates
  disposition_filter: 20                     # 20 = Issued
  fields:
    - SerialNumber
    - NotAfter
    - NotBefore
    - SubjectDN
    - SubjectEmail
    - CertificateTemplate
    - SignatureAlgorithm
    - PublicKeyAlgorithm
    - PublicKeyLength
    - Disposition
    - RevokedReason
  include_revoked: false
  max_results: 100000

schedule:
  interval: "6h"                             # Run every 6 hours
  timeout: "30m"

output:
  format: cbom_json
  destination: cbom-api
  api_endpoint: "https://cbom.contoso.internal/api/v1/ingest"
  api_key_secret_ref: "cbom-vault://api/ingest-key"

logging:
  level: info
  log_file: "/var/log/cbom/discover_pki_adcs.log"

7. Validation

After deploying the sensor configuration, follow these steps to confirm the sensor is operating correctly.

Start or reload the CBOM agent to apply the new sensor configuration:

sudo systemctl reload cbom-agent
# or on Windows:
Restart-Service -Name CBOMAgent

Tail the sensor log to observe the first discovery run:
```
tail -f /var/log/cbom/discover_pki_adcs.log
```

Confirm log lines similar to the following appear, indicating a successful connection and ingestion:

[INFO]  Discover_PKI: Connected to CA CASERVER01\MyEnterpriseCA
[INFO]  Discover_PKI: Enumerated 4,821 issued certificates
[INFO]  Discover_PKI: Ingested 4,821 records to CBOM API (200 OK)
[INFO]  Discover_PKI: Next run scheduled at 2026-06-29T12:00:00Z

Log into the CBOM dashboard and navigate to Assets > Certificates. Filter by Source: ADCS / CASERVER01\MyEnterpriseCA and confirm certificates appear with correct serial numbers and expiration dates.

Spot-check a specific certificate by querying the CA directly and comparing the serial number to what the CBOM dashboard shows:

certutil -view -config "CASERVER01\MyEnterpriseCA" ^
  -restrict "SerialNumber=1a2b3c4d5e6f7a8b" ^
  -out "SerialNumber,NotAfter,SubjectDN"

8. Common Errors and Resolution

Error 1: Access Denied When Running certutil -view

Message:

CertUtil: -view command FAILED: 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)

Cause: The service account svc-cbom-pki does not have Read permission on the CA, or the permission change was applied but the certsvc service was not restarted.

Fix:

Verify the ACL on the CA using certsrv.msc > CA Properties > Security.
Confirm svc-cbom-pki has Read checked under Allow.
Restart Certificate Services on the CA server:
```
net stop certsvc && net start certsvc
```
Re-run the certutil -view command as the service account.

Error 2: RPC Server Unavailable

Message:

CertUtil: -view command FAILED: 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)

Cause: The CBOM sensor host cannot reach the CA server over DCOM/RPC. The Windows Firewall on the CA server is blocking TCP 135 or the dynamic high ports used by DCOM.

Fix:

Confirm the CA server is reachable via ping and that DNS resolves CASERVER01.contoso.com correctly.

On the CA server, ensure the following firewall rules are enabled:

Enable-NetFirewallRule -DisplayGroup "Remote Volume Management"
Enable-NetFirewallRule -DisplayName "Certification Authority (DCOM-In)"

If a perimeter firewall exists between the sensor host and the CA, open TCP 135 and TCP 49152-65535 (DCOM dynamic range) from the sensor host IP to the CA server IP.

Re-test connectivity:

certutil -ping -config "CASERVER01\MyEnterpriseCA"

Error 3: CA Configuration String Not Found

Message:

CertUtil: -config "CASERVER01\MyEnterpriseCA" command FAILED: 0x80070057
The parameter is incorrect.

Cause: The ca_config value in the CBOM sensor YAML uses an incorrect CA name. The CA Common Name in the configuration string must exactly match the name registered in Active Directory, including casing.

Fix:

Enumerate all available CAs on the network to find the correct name:
```
certutil -dump
```
or
```
certutil -config - -ping
```
This opens a dialog or list showing all discoverable CAs and their exact Server\CAName strings.
Update the ca_config field in the sensor YAML to match the exact CA name returned by certutil -dump.
Note that backslashes must be escaped in YAML as \\:
```
ca_config: "CASERVER01\\MyEnterpriseCA"
```

9. Security Recommendations

Use a dedicated, non-interactive service account. Never use a shared account or a human user account for the CBOM sensor. Set PasswordNeverExpires only if mandated by your rotation policy; otherwise integrate with a secrets manager (such as CyberArk or HashiCorp Vault) for automated rotation.
Store credentials in the CBOM secrets vault. Never place plaintext passwords in the sensor YAML. Use the password_secret_ref field to reference secrets stored in the CBOM vault or an external secrets manager.
Apply the principle of least privilege strictly. The service account should hold only the CA Read permission. Do not grant Issue and Manage Certificates, Request Certificates, or any administrative rights. Audit the CA ACL quarterly.
Restrict network access. Use firewall rules or Windows Defender Firewall to allow DCOM/RPC traffic only from the CBOM sensor host IP to the CA server. Block all other inbound connections on the dynamic RPC port range from untrusted sources.
Enable audit logging on the CA. Configure the CA to log certificate enumeration events by enabling the AUDIT_CERTSRV_ENUMERATECAS audit category. This provides traceability if the service account is ever used for unauthorized enumeration:
```
certutil -setreg CA\AuditFilter 127
net stop certsvc && net start certsvc
```

10. Conclusion

This guide has walked through creating a read-only Windows service account, granting the minimum necessary permissions on a Microsoft AD CS Certificate Authority, validating access with certutil, and deploying the CBOM Discover_PKI sensor to enumerate issued certificates. By following the least-privilege model described here, the CBOM sensor can maintain a continuously updated cryptographic inventory of all PKI-issued certificates without any risk of modifying the CA or its certificate database. Regular validation runs and audit log reviews will ensure the integration remains healthy and compliant with your organization's security policies.

CBOM Secure

Microsoft Active Directory Certificate Services Setup Guide for CBOM PKI Sensor

1. Purpose

2. Prerequisites

3. Create a Dedicated Service Account in Active Directory

3.1 Create the Service Account

3.2 Restrict Logon Rights (Hardening)

4. Grant Read-Only Access to the Certificate Authority

4.1 Grant Read Permission via certsrv.msc (GUI Method)

4.2 Grant Read Permission via certutil (CLI Method)

4.3 Verify Effective Permissions

5. Verify CA Connectivity and Certificate Enumeration

5.1 Test Certificate Enumeration

5.2 Test with a Restricted Query

6. Configure CBOM Sensor

7. Validation

8. Common Errors and Resolution

Error 1: Access Denied When Running certutil -view

Error 2: RPC Server Unavailable

Error 3: CA Configuration String Not Found

9. Security Recommendations

10. Conclusion

On this Page: