Diving Into AD CS: Exploring Some Common Error Messages

This report is a practitioner-focused deep dive into Active Directory Certificate Services (AD CS) abuse and PKINIT authentication, explaining how and why common Kerberos errors occur during certificate-based attacks. It clarifies the distinction between certificate issuance and authentication, highlights EKU and CA trust prerequisites, and shows how expired or missing DC certificates trigger failures, while also demonstrating Schannel-based Pass-the-Cert as an alternative path when PKINIT is blocked. The content provides actionable TTPs and troubleshooting steps rather than describing a specific incident.