Troubleshooting

No AD CS events appear in ADAudit Plus reports

Symptom: You can see the AD CS server in ADAudit Plus, but no AD CS-related events appear in reports or searches.

Resolution:

Confirm CA auditing is enabled:

• Recheck the Auditing tab in the Certificate Authority console.
• Make sure the required CA categories are selected.

Confirm Windows audit policy is enabled:

• Run auditpol /get /subcategory:"Certification Services".
• Verify that Success and Failure are enabled.

Confirm events exist locally first:

• Open Event Viewer → Windows Logs → Security.
• Look for AD CS event IDs such as 4886, 4887, 4888, 4870, 4882, 4891, 4892.

Confirm connectivity and scope:

• Verify that the AD CS server is the same server configured in ADAudit Plus.
• Confirm the server is not disabled or excluded from collection.

Automatic audit policy configuration does not apply on a member server

Symptom: ADAudit Plus shows the member server as configured, but the Certification Services audit policy is not enabled on the AD CS server.

Resolution:

Confirm the correct onboarding path:

• Make sure the AD CS host was added under Configuration → Data Sources → Member Servers.

Confirm the product-managed GPO workflow:

• Verify that the member-server automatic configuration uses the expected `<DomainName>_ADAuditPlusPolicy` GPO.
• Verify that the intended server is in scope for the `ADAuditPlusFS` targeting model used by the product.

Force policy refresh:

• Run gpupdate /force on the AD CS member server.
• Recheck the policy with auditpol /get /subcategory:"Certification Services".

Review GPO replication and security filtering:

• Confirm that the GPO has replicated and that security filtering is not excluding the target server.

The Certification Services audit subcategory is still disabled after GPO changes

Symptom: You enabled the policy in GPMC, but auditpol still shows the subcategory as disabled or mismatched.

Resolution:

Confirm you edited the correct GPO:

• Use Default Domain Controllers Policy for Domain Controllers.
• Use ADAuditPlusMSPolicy for member servers.

Confirm the advanced audit setting itself:

• Reopen Object Access → Audit Certification Services.
• Make sure both Success and Failure are selected.

Force advanced policies over legacy policies:

• Confirm that Audit: Force audit policy subcategory settings ... is Enabled.

Check for conflicting baselines:

• Review whether another GPO or hardening baseline is overwriting the setting.

Events exist in Event Viewer but not in ADAudit Plus

Symptom: The Security log contains AD CS events, but ADAudit Plus reports remain empty or incomplete.

Resolution:

Validate collection health:

• Confirm the server status is healthy in ADAudit Plus.
• Verify the agent state if agent-based collection is used.

Validate privileges:

• Confirm that the configured collection identity can read the Security log.
• Review the required privileges in the Accounts & Privileges Guide.

Validate firewall connectivity:

• Confirm that required agentless ports are open, especially 135, 445, and the dynamic RPC range.

Compare time ranges:

• Increase the report time range.
• Confirm that system clocks are synchronized between the AD CS server and the ADAudit Plus server.

Certificate template changes are not being audited

Symptom: You can see core CA events, but certificate template-related activity is missing.

Resolution:

Confirm the template auditing command was run correctly:

• Open an elevated Command Prompt.
• Re-run the command from Enable certificate template change monitoring if needed.

Confirm the CA type:

• Template monitoring guidance in this guide applies only to Enterprise CA deployments.

Generate a controlled validation change:

• Perform an approved template-related action in a lab or change-controlled environment.
• Check whether the related event appears in the Security log first.

Review report filters:

• Use server name, event ID, and recent time range filters in ADAudit Plus.

Access is denied when you try to configure or collect AD CS audit data

Symptom: You receive access-denied errors during GPO edits, CA auditing changes, or event collection.

Resolution:

Confirm CA configuration permissions:

• Use Domain Admin credentials to change CA auditing or edit the required GPOs.

Confirm collection permissions:

• Ensure the collection identity has the required Security log access in your environment.
• Review Event Log Readers and Manage Auditing and Security Log requirements.

Confirm remote access rights:

• If you use agentless collection, validate remote event log and Windows management connectivity.

Review privilege design:

• Use the Accounts & Privileges Guide to validate least-privilege design before broadening access.

The CA is a Standalone CA and no AD CS audit data is available

Symptom: The CA is reachable and logs local activity, but ADAudit Plus does not provide supported AD CS auditing results.

Resolution:

Confirm the CA architecture:

• Verify whether the CA is an Enterprise CA or Standalone CA.

Apply the support boundary:

• ADAudit Plus does not support AD CS auditing for Standalone CA architecture.

Avoid further feature troubleshooting:

• Do not continue spending effort on policy or port troubleshooting for an unsupported architecture.

Plan the next step:

• If Enterprise CA auditing is required, review your PKI architecture and product support options with the relevant stakeholders.

Frequently Asked Questions (FAQ)

Q1: Does ADAudit Plus support AD CS auditing for Standalone CA deployments?

No. ADAudit Plus supports AD CS auditing only for Enterprise CA architecture. See Enterprise CA vs. Standalone CA.

Q2: Do I need the Member Servers add-on if the CA is installed on a member server?

Yes. If the AD CS role is installed on a Windows member server, confirm that the Member Servers add-on is licensed before relying on AD CS data collection.

Q3: If AD CS is installed on a Domain Controller, should I add it again as a member server?

No. Configure it through the domain and Domain Controller workflow under Configuration → Data Sources → Domains and Controllers.

Q4: Which audit policy setting does ADAudit Plus need for AD CS auditing?

ADAudit Plus requires the Audit Certification Services subcategory enabled for Success and Failure under Advanced Audit Policy Configuration → Object Access. This is applied automatically when you use automatic configuration, or manually in Configure advanced audit policies. See Recommended audit policy settings for AD CS for the full baseline.

Q5: How do I enable certificate template change monitoring?

Run the certutil command in Enable certificate template change monitoring from an elevated Command Prompt on the AD CS server.

Q6: Where are the AD CS reports in ADAudit Plus, and which event IDs are most useful?

Navigate to Server → Server Auditing → AD CS Activity. Start with AD CS Activity Overview, then use the five sub-reports. For quick validation, the most useful event IDs are 4886 (request received), 4887 (approved), 4888 (denied), 4870 (revoked), 4882 (security permissions changed), 4891/4892 (configuration changed), and 4899/4900 (template changed). See AD CS reports in ADAudit Plus for the full list.

Q7: Is Windows Server 2025 supported for AD CS auditing?

Yes. Windows Server 2025 is supported for AD CS auditing in ADAudit Plus 7200 and later.