Overview

    Purpose of this guide

    This guide explains how to configure ADAudit Plus for Active Directory Certificate Services (AD CS) auditing. AD CS is an infrastructure data source in the ADAudit Plus taxonomy, and this guide focuses on auditing Enterprise Certificate Authority (CA) activity on supported Windows Server platforms.

    Use this guide when you want to:

    1. Add an AD CS server to ADAudit Plus.
    2. Configure the required audit policies.
    3. Enable CA-level auditing on the AD CS server.
    4. Verify that AD CS events are generated and collected.
    5. Use ADAudit Plus reports and alerts to review certificate service activity.

    AD CS auditing helps you detect and investigate certificate-related administrative activity, including certificate request approvals and denials, certificate revocation activity, CA security changes, and other high-value PKI operations.

    Important ADAudit Plus supports AD CS auditing only when the CA uses the Enterprise CA architecture. Standalone CA deployments are not supported for AD CS event auditing.
    Note If your CA is installed on a Domain Controller, use the domain and Domain Controller configuration workflow. If your CA is installed on a Windows member server, use the member server workflow and confirm the required Member Servers add-on licensing.

    What ADAudit Plus audits on AD CS servers

    ADAudit Plus helps you monitor certificate service activity generated by supported AD CS servers, including:

    • CA configuration changes
    • CA security setting changes
    • Certificate request submission, approval, denial, and modification activity
    • Certificate revocation and CRL publication events
    • Archived key storage and retrieval events
    • Certificate template-related changes when template auditing is enabled
    • CA operational events that may be relevant for investigation, including start/stop and backup/restore activity where available

    The following table summarizes the main AD CS activity areas covered by this guide.

    AD CS activity area What it helps you monitor Why it matters
    Certificate request processing Request receipt, approval, denial, attribute changes, and extension changes Helps you review who requested, approved, or rejected certificates
    CA configuration Changes to CA properties and operational settings Helps you detect configuration drift and unauthorized changes
    CA security Changes to CA permissions and security-related configuration Helps you track privileged changes to your PKI control plane
    Certificate lifecycle Revocation activity and CRL publication Helps you verify revocation workflows and incident response actions
    Archived key operations Storage and retrieval of archived keys Helps you monitor sensitive recovery-related operations
    Template monitoring Changes to template usage and load-related auditing Helps you detect PKI template misuse and operational changes

    Tip AD CS auditing is most valuable when you combine it with Active Directory auditing, alerting, and least-privilege account planning.

    Supported Windows Server versions

    ADAudit Plus can audit supported Windows Server versions that host the AD CS role with the Enterprise CA architecture installed.

    Windows Server version AD CS auditing status
    Windows Server 2008 / 2008 R2 Supported
    Windows Server 2012 / 2012 R2 Supported
    Windows Server 2016 Supported
    Windows Server 2019 Supported
    Windows Server 2022 Supported
    Windows Server 2025 Supported