ADCS Health Check: 50 Controls to Review Every Month

Most AD CS problems aren’t discovered, they’re rediscovered, weeks or months after something quietly changed. A monthly health check closes that gap without requiring a full assessment every thirty days. This is a concrete, 50-item checklist across the eight areas that matter most: CA service health, CRL/OCSP, templates, permissions, backups, HSMs, events, and dependencies.

TL;DR: Key Takeaways

• This is a monthly cadence tool, not a replacement for deeper assessments: pair it with periodic ESC1-ESC16 scans and full audits, covered elsewhere in our series, rather than treating it as sufficient on its own.
• Most items are fast comparisons against an existing baseline, not fresh investigations, which is what makes a genuine monthly cadence realistic.
• Log every failed item as a tracked finding, with a severity and either a remediation deadline or a documented exception, not an informal fix with no record.
• If time is limited, prioritize templates and permissions first, these map most directly to known privilege escalation paths.

CA Service Health (7)

1. Confirm Certificate Services is running on every CA and hasn’t restarted unexpectedly since the last check.
2. Compare current certutil -cainfo output against last month’s baseline for unexpected changes.
3. Review CA database size and growth trend against your documented baseline.
4. Confirm no new 0x80070006 handle-invalid errors have been logged since the last review.
5. Confirm this month’s database backup completed successfully.
6. Review CPU, memory, and disk utilization trend on each CA server for early signs of degradation.
7. Confirm every subordinate CA’s certificate validity still fits within its parent’s remaining validity window.

CRL/OCSP (7)

8. Confirm the base CRL published on schedule at every configured CDP location.
9. Confirm the delta CRL, if used, published on schedule.
10. Run an actual retrieval test against every published CDP/AIA URL from an external vantage point.
11. Confirm the OCSP responder service is running on every instance, including every array member.
12. Check OCSP signing certificate expiration against at least a 60-day threshold.
13. Confirm OCSP array member configuration matches the controller, with no sync drift.
14. If CRL partitioning is in use, confirm every partition published successfully, not just the aggregate status.

Certificate Templates (7)

15. Re-run an ESC1-ESC16 detection scan and confirm no new findings since last month.
16. Confirm no new schema version 1 templates were published this month.
17. Review enrollment agent scope against your documented, approved list.
18. Confirm no unexpected EKU or Application Policy changes since your last baseline.
19. Confirm no unexpected enrollee-supplied-subject or manager-approval changes since your last baseline.
20. Review the CA’s issuance list (certutil -CATemplates) against your documented baseline.
21. Spot-check a newly issued certificate for correct SID extension or strong mapping data.

Permissions (6)

22. Review CA-level Manage CA and Manage Certificates rights against your documented administrator list.
23. Review template ACLs for unexpected WriteDACL, WriteOwner, or GenericAll grants.
24. Confirm NTAuth store membership is correct and unchanged.
25. Confirm no dangerous CA-wide policy flags, such as EDITF_ATTRIBUTESUBJECTALTNAME2, are enabled.
26. Review local Administrators group membership on every CA and NDES server.
27. Confirm Tier 0 service accounts haven’t been reused on any lower-tier system.

Backups (6)

28. Confirm this month’s full backup, database, key, registry, and CAPolicy.inf, completed successfully.
29. Verify backup integrity through a test restore on the schedule your policy requires, and flag it if overdue.
30. Confirm CAPolicy.inf specifically is included in the current backup set.
31. Confirm certificate template objects are covered by your Active Directory backup.
32. Review backup storage access controls for Tier 0-equivalent protection.
33. Confirm your documented RTO and RPO targets are still realistic against your most recent recovery test results.

HSMs (6)

34. Confirm HSM client connectivity and session health from every CA.
35. Confirm HSM firmware and driver versions remain compatible with your current OS patch level.
36. Review the HSM partition access control list for unexpected principals.
37. Confirm NDES’s RA key protection meets the same rigor as your CA keys.
38. Confirm no unexplained key container creation events appear in HSM logs.
39. Review HSM audit logs for the period for anomalies.

Events (6)

40. Confirm the CA’s AuditFilter remains set to capture every category, with no unexplained Event 4885 entries.
41. Review Event IDs 4886 through 4889 for Requester-to-Subject mismatch patterns.
42. Review the denial rate (Event 4888) trend for spikes concentrated on one requester.
43. Confirm every CA configuration change event (4890-4898) maps to an authorized change ticket.
44. Confirm your SIEM is actually receiving CA events, checking pipeline health, not just the source.
45. Review NDES’s MSCEP registry monitoring (Events 4657/4670) for unexpected changes.

Dependencies (5)

46. Confirm NDES’s service state and IIS application pool health.
47. Confirm the Intune Certificate Connector version is current and checking in.
48. Confirm domain controller OS versions relevant to strong certificate mapping remain compliant.
49. Confirm any cross-certificates in your hierarchy are still valid and documented.
50. Confirm your topology map and documentation reflect any infrastructure changes made this month.

How Encryption Consulting Can Help

Running this checklist consistently every month, and knowing what to do when an item fails, is where a good checklist turns into a genuine operating practice rather than a document nobody follows past the second month.

Encryption Consulting’s PKI Services team supports this directly:

• Monthly health check execution: running this full 50-point review against your actual environment, with the context to interpret findings correctly.
• Baseline establishment: building the configuration, template, and permission baselines this checklist compares against.
• Finding tracking and remediation: turning failed items into tracked, resolved work rather than an ignored backlog.
• Automation support, scripting the checks that can be automated so the monthly review takes minutes, not hours.
• Escalation into deeper assessment, when a monthly finding warrants a full ESC1-ESC16 scan or incident investigation.

If you want this checklist run against your environment every month without it falling on your team’s already-full plate, our PKI Services team can own it.

Conclusion

Fifty items sounds like a lot until you realize most of them are quick comparisons against a baseline you already have, not new investigations. Run this monthly, log every failure as a tracked finding, and pair it with the deeper, periodic assessments covered throughout our broader AD CS series. The goal isn’t a perfect score every month, it’s catching drift while it’s still a checklist item and not an incident.

Related reading: ADCS ESC1-ESC16 Detection Playbook · Certificate Template Drift Monitoring for Microsoft ADCS · ADCS Telemetry Guide: Events, Metrics, Logs, and Alerts · Continuous ADCS Risk Assessment vs One-Time Audits · Your Guide To Do A PKI Health Check

Want this monthly checklist run against your environment without adding to your team’s workload? Talk to our PKI Services team. Encryption Consulting is ISO/IEC 27001:2022 and SOC 2 certified.

FAQ

Is a 50-point monthly checklist a substitute for a full AD CS security assessment? No. This checklist is designed to catch drift and operational issues between deeper reviews, such as a full ESC1-ESC16 assessment or an annual audit. It’s a monthly cadence tool, not a replacement for periodic, in-depth technical assessment.

How long does this monthly health check typically take to complete? For a single-CA environment with existing telemetry and documentation, most of these 50 items can be confirmed in under an hour, since many are quick comparisons against an existing baseline rather than fresh investigations. Larger, multi-CA hierarchies take proportionally longer.

What should happen when a monthly health check item fails? Log it as a finding with a severity and either a remediation deadline or a formal, documented exception, consistent with the compliance monitoring practice covered elsewhere in our AD CS series, rather than fixing it informally with no record.

Which of these 50 items matters most if time is limited? Prioritize the certificate template and permissions categories first, re-running an ESC1-ESC16 scan and reviewing CA-level and template permissions for unexpected grants, since these map most directly to known privilege escalation paths.