The engagement
Evidence in. Risk out.
A controlled five-step process from scope to verification. You know what access is needed, what is collected and what your engineers will receive before work begins.
How a health check runs
Five steps. Two weeks.
No changes to production.
-
01
Scoping call
Thirty minutes. Hierarchy, scale, constraints, and whether an audit is even the right first move. If it is not, we will say so. No credentials change hands on this call.
-
02
Read-only evidence collection
Scripted and non-intrusive. Run by your team, or by us with your team watching. Nothing is written, nothing is restarted, nothing is enrolled — and the script is yours to read first.
-
03
Analysis
Templates and permissions tested against the known escalation paths. Revocation, key protection, algorithm and validity hygiene tested against operational failure modes.
-
04
Risk-ranked report
Every finding with impact, exploitability and a specific remediation — ordered so that the first week of work removes the most risk.
-
05
Remediation walkthrough
A working session with your engineers. You can fix it yourselves, or we can. Either way you keep the documentation and the verification scripts.
PS> Get-CAHierarchy -Summary
Forest : corp.example.com
Enterprise CAs : 3
ROOT-CA-01 Offline SHA256 RSA4096 exp 2039
ISSUING-CA-01 Online SHA256 RSA2048 exp 2031
ISSUING-CA-02 Online SHA1 RSA2048 exp 2029
Published templates : 41
Endpoints (est.) : 5,000 – 15,000
# scope agreed. no credentials exchanged.PS> .\Collect-AdcsEvidence.ps1 -ReadOnly -Out .\evidence
[ok] enumerating CAs ................ 3
[ok] exporting template ACLs ........ 41
[ok] reading CA registry ............ 6
[ok] probing CDP / AIA endpoints .... 14
[ok] sampling issued certificates ... 500
[--] write operations attempted .... 0
[--] services restarted ............. 0
evidence written · SHA256 manifest signedPS> certutil -v -dstemplate WorkstationAuth
msPKI-Certificate-Name-Flag = 1 (0x1)
CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT
pKIExtendedKeyUsage = "1.3.6.1.5.5.7.3.2"
Client Authentication
msPKI-Enrollment-Flag = 0 (0x0)
manager approval not required
>> supplied SAN + client auth + no approval
>> matches ESC1 — flag CRITICALPS> Get-Content .\report\index.md
# Findings — ordered by risk removed
1 CRITICAL ESC1 WorkstationAuth
2 CRITICAL ESC8 web enrolment over HTTP
3 HIGH ESC4 ACL: Authenticated Users
4 HIGH KEY-01 issuing CA key in software
5 HIGH REV-02 CDP unreachable externally
… 13 further findings
# each finding: impact · exploitability · fixPS> .\Verify-Remediation.ps1 -Finding ESC1
before ENROLLEE_SUPPLIES_SUBJECT = 1
after ENROLLEE_SUPPLIES_SUBJECT = 0
after msPKI-Enrollment-Flag = PEND_ALL_REQUESTS
[ok] re-test: SAN injection refused
[ok] re-test: issued certificates unaffected
# your engineers ran this. we watched.Representative output. Collection scripts are supplied for your review before anything runs.
Access
Read-only is usually enough.
The collection method is supplied for review. Your team can run it, or we can run it while they watch. An assessment does not need service restarts, certificate enrolment or configuration changes.
- Account
- Low-privilege domain account in most estates
- Host
- Domain-joined administrative workstation
- Writes
- None during assessment collection
- Review
- Collection script available before execution
Data handling
Evidence is handled like evidence.
The final retention period and approved transfer route are agreed in the statement of work, so data handling is explicit rather than assumed.
- Read-only access preferred and sufficient for assessment
- NDA by default, signed before evidence collection
- Evidence encrypted at rest, deleted on a stated retention schedule
- Collection scripts supplied for review before they are run
Exact hosting, transfer and deletion controls are documented per engagement and adjusted to client policy where required.
The handover
A report your engineers can operate from.
Findings are ranked by risk and paired with specific remediation and verification. The walkthrough transfers context, not just a PDF.