Everything Truvald™
checks, monitors, and reports.

ESC Attack Path Controls (Selected)

• ESC-001
  SAN Supply via Template

  Templates allowing enrollees to supply Subject Alternative Names with broad enrollment permissions and no manager approval.
  Critical
• ESC-003
  Enrollment Agent Abuse

  Templates that allow enrollment on behalf of another user without constrained delegation — impersonation to Domain Admin.
  Critical
• ESC-004
  Template Write Access

  Non-privileged principals with write access to template objects in Active Directory — modification to introduce ESC-001.
  Critical
• ESC-006
  EDITF_ATTRIBUTESUBJECTALTNAME2

  CA-level flag that allows SAN supply on any template — effectively ESC-001 for every template published on this CA.
  Critical
• ESC-008
  NTLM Relay to ADCS HTTP

  Web enrollment endpoints (certsrv) exposed without EPA, enabling NTLM relay attacks for machine certificate theft.
  High
• ESC-016
  Unauthorized CA in NTAuth Store

  Rogue CAs present in the NTAuthCertificates store — can issue certificates for AD authentication without authorization.
  Critical

CA & OS Controls (Selected)

• CA-002
  CA Certificate Validity

  CA certificate expiry status and remaining lifetime. An expired CA certificate is a catastrophic event — caught here before your users experience it.
  Critical
• CA-005
  CA Audit Policy

  Verifies that the CA is configured to audit certificate requests, approvals, denials, and revocations. Missing audit events mean blind spots.
  Moderate
• CA-013
  HSM Key Protection

  CA private key stored in a Hardware Security Module vs. software-only key container. Software keys are extractable by an attacker with local admin.
  High
• OS-007
  WDigest Authentication

  WDigest enabled causes plaintext credentials to be cached in LSASS memory — retrievable by any process with debug privilege.
  High
• OS-019
  CA Role Separation

  Validates that users in PKI administrative groups follow appropriate Tier 0 separation — no domain admin accounts in CA admin roles.
  Moderate
• CA-019
  CRL Freshness

  CRL publication status, time to next update, and delta CRL configuration. A stale CRL causes certificate validation failures across your entire environment.
  Good

• Discovers all templates published across configured CAs
• Maps ESC attack surface for each template — enroll, autoenroll, full control, write
• Cryptographic algorithm, minimum key size, and signature hash review
• Validity period and renewal window review
• Export full template inventory to PDF or Excel
• Template OID, internal name, and display name cross-reference
• Subject name format — Supplied by Requester vs. Built from AD flags
• Manager approval requirement and enrollment agent restrictions

• Reads GPO data directly from SYSVOL — works even with Remote Registry disabled
• LDAP walk of OU hierarchy to discover linked GPOs by gPLink attribute
• Conflict detection — same registry key defined differently across GPOs
• OS-inappropriate setting detection — workstation policies on CA servers
• GPO application order display — exactly which value wins and why
• Risk acceptance for GPO findings with PIN verification and audit record

DR documentation is generated from live data — not filled in manually by an admin who hasn't touched the CA since 2021. Every time you generate it, it reflects the actual current state of your CA configuration: cryptography, extensions, CRL distribution points, key storage, role assignments, and recovery procedures specific to your environment.

Keep it in your runbook. Store it with your HSM credentials. Give it to your disaster recovery team. It's the document that gets your PKI back online instead of rebuilt from scratch.

Every control in a Truvald™ assessment report includes direct references to the authoritative source that defines it — so findings aren't just assertions, they're documented positions you can defend. When an auditor asks why ESC-003 is a Critical, the answer is in the report with a link to the research that established it.

References include NIST publications (SP 800-57, SP 800-32), Microsoft PKI documentation and security advisories, SpecterOps Certified Pre-Owned research, CIS benchmarks, and RFC specifications where applicable. The report your CISO hands to an auditor has the receipts built in.

Post-quantum cryptography isn't a distant concern — NIST finalized its first post-quantum standards in 2024, and organizations are beginning the long process of inventorying and migrating their cryptographic infrastructure. PKI is at the center of that transition.

Truvald™ assesses the cryptographic posture of your entire CA hierarchy: key algorithms, key lengths, signature algorithms, hash functions across CAs, templates, and issued certificates. That inventory is the starting point for any quantum readiness program — you can't migrate what you haven't mapped.

Controls flag RSA key lengths below current NIST guidance, weak hash algorithms (MD5, SHA-1), and cryptographic configurations that will need to be addressed as post-quantum standards are adopted into Windows and enterprise PKI tooling. Truvald™ gives you the map. The migration work is yours — but at least you know what you're walking into.

Not everything about PKI security can be verified by reading a registry key. The Operational Readiness Survey covers the governance side — 26 structured questions that map directly to SRV-series controls and affect your overall assessment posture.

Survey answers are PIN-protected — because they're part of your audit record and changes should be intentional. Every edit is logged with timestamp and reason. Answering "Yes" produces a Good finding. Leaving it blank — or answering "No" — produces a finding at the appropriate severity.