Overview

Purpose of this guide

This guide explains how to configure ADAudit Plus for Active Directory Certificate Services (AD CS) auditing. AD CS is an infrastructure data source in the ADAudit Plus taxonomy, and this guide focuses on auditing Enterprise Certificate Authority (CA) activity on supported Windows Server platforms.

Use this guide when you want to:

1. Add an AD CS server to ADAudit Plus.
2. Configure the required audit policies.
3. Enable CA-level auditing on the AD CS server.
4. Verify that AD CS events are generated and collected.
5. Use ADAudit Plus reports and alerts to review certificate service activity.

AD CS auditing helps you detect and investigate certificate-related administrative activity, including certificate request approvals and denials, certificate revocation activity, CA security changes, and other high-value PKI operations.

What ADAudit Plus audits on AD CS servers

ADAudit Plus helps you monitor certificate service activity generated by supported AD CS servers, including:

• CA configuration changes
• CA security setting changes
• Certificate request submission, approval, denial, and modification activity
• Certificate revocation and CRL publication events
• Archived key storage and retrieval events
• Certificate template-related changes when template auditing is enabled
• CA operational events that may be relevant for investigation, including start/stop and backup/restore activity where available

The following table summarizes the main AD CS activity areas covered by this guide.

AD CS activity area	What it helps you monitor	Why it matters
Certificate request processing	Request receipt, approval, denial, attribute changes, and extension changes	Helps you review who requested, approved, or rejected certificates
CA configuration	Changes to CA properties and operational settings	Helps you detect configuration drift and unauthorized changes
CA security	Changes to CA permissions and security-related configuration	Helps you track privileged changes to your PKI control plane
Certificate lifecycle	Revocation activity and CRL publication	Helps you verify revocation workflows and incident response actions
Archived key operations	Storage and retrieval of archived keys	Helps you monitor sensitive recovery-related operations
Template monitoring	Changes to template usage and load-related auditing	Helps you detect PKI template misuse and operational changes

Tip: AD CS auditing is most valuable when you combine it with Active Directory auditing, alerting, and least-privilege account planning.

Supported Windows Server versions

ADAudit Plus can audit supported Windows Server versions that host the AD CS role with the Enterprise CA architecture installed.

Windows Server version	AD CS auditing status
Windows Server 2008 / 2008 R2	Supported
Windows Server 2012 / 2012 R2	Supported
Windows Server 2016	Supported
Windows Server 2019	Supported
Windows Server 2022	Supported
Windows Server 2025	Supported