Windows 10: KB5005413: Mitigating NTLM Relay Attacks on Active Directory Certificate Services AD CS

Hello,https://support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429In order to mitigate the above vulnerability MS has given some steps to perform.we have Certificate Authority Web Enrollment installed in our server and to mitigate the issue we had performed step 1 mentioned under primary mitigation. once the mitigation is completed I was checking in the registry that it stores any data about it but could not find any.Can anyone please help me to understand after performing the mitigation st

:)

 

Active Directory Certificate Services

I would like to verify various modules within our network. Active Directory Certificate Services seems to be the ideal way to do this.

Is there a charge for creating these certificates with AD CS? Any of the modules will be used only within our Active Directory domain...

 

Cannot manage Active Directory Certificate Services. Access is denied. 0x80070005 Win32:5

getting following error, When I trying to connect CS server using MMS form different server.

But user trying to connect from different domain and we have two way trust between both the servers. user have appropriate permission under CS server.

Please let me know if need any other details.

Cannot manage Active Directory Certificate Services. Access is denied. 0x80070005 Win32:5

 

Microsoft Active Directory Certificate Service

Hi

I have some question on Active Directory Certificate Service:

Currently, we have a Hierarchy PKI in our organization the Root of which use Microsoft Server 2003 Service. Now we want to migrate and make another parallel Hierarchy and using Windows Server 2016 service
in the new root CA. But we want to set up an interoperability relationship between these two hierarchies. Thinking on using CTL or One-way Cross-Certification, we are not sure which one is more suitable for our situation. What is your suggestion?

My other question is about to include Extended Validation and Friendly Name Properties in my new Standalone Root CA's certificate which will be set up on windows server 2016. We have tried different ways
to include these properties by use of CApolicy.inf, but we have not made any progress till now. Could you please help us and tell me how we can do this?