Script_ADCS_CVE_fix

Overview

This executable applies hardening settings for Active Directory Certificate Services (AD CS) web roles to reduce exposure to NTLM relay attacks. It targets Certificate Authority Web Enrollment (CA Web Enrollment) and Certificate Enrollment Web Service (CES) configurations.

AD CS NTLM Relay Mitigations

CVE-2021-36942 and CVE-2022-26925

Executable: Script_ADCS_CVE_fix.exe

Solution

1. Access the Device

• Log in to the Windows device where the mitigation needs to be applied.

• Ensure that you have the required Administrator privileges.

2. Detect the AD CS Roles

The executable checks whether the following AD CS server components are installed:

• ADCS-Web-Enrollment

• ADCS-Enroll-Web-Svc

The configuration is applied based on whether the corresponding AD CS role is present.

3. Configure IIS Settings

When the applicable AD CS roles are installed, the executable updates the IIS applicationHost.config configuration for the following locations:

• CertSrv Kerberos

• CES Kerberos

4. Configure Extended Protection

The executable applies the following extended protection settings:

• Sets tokenChecking to Require.

• Enables Windows Authentication.

• Enables kernel-mode authentication.

5. Configure Transport Security

The executable sets the sslFlags value to Ssl for the targeted AD CS web endpoints.

This ensures that the targeted AD CS web endpoints require SSL.

6. Configure CES web.config

For the CES Kerberos binding, the executable sets:

• extendedProtectionPolicy policyEnforcement to Always.

7. Apply the Configuration

The executable runs silently and loads the relevant XML configuration files.

It then:

• Adds missing configuration elements.

• Updates existing configuration attributes.

• Saves the modified configuration files.

• Applies the changes only when the corresponding AD CS role is installed.

What the Executable Does

The executable silently loads the relevant XML configuration files, adds missing elements or updates existing attributes, and saves the modified files. The changes are conditional on the corresponding AD CS role being installed.

References

Microsoft KB5005413: Mitigating NTLM Relay Attacks on AD CS:
https://support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429

Microsoft Security Update Guide: CVE-2021-36942:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942

Microsoft Security Update Guide: CVE-2022-26925:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26925