Event ID 4887: Certificate Services approved a certificate request and issued a certificate
Written on Active Directory Certificate Services servers when a certificate is issued.
- Log
- Security
- Category
- Active Directory
Why it matters
- Certificates issued for another user's name through a misconfigured template can be used to log on as that user.
What to check
Check the requester, the template and the subject or alternative name in the certificate.
How to turn it on
Advanced Audit Policy on the CA: Object Access > Audit Certification Services, and auditing turned on in the CA's settings.
MITRE ATT&CK
- T1649 Steal or Forge Authentication Certificates