ad-cs 开源项目推荐（18 个）

jakehildreth /Locksmith

A small tool built to find and fix common misconfigurations in Active Directory Certificate Services.

grindsa /acme2certifier

ACME 代理增强您现有的证书授权中心基础设施

jakehildreth /Locksmith2

An AD CS toolkit for AD Admins, Defensive Security Professionals, and Filthy Red Teamers

Obsidian-Strike /active-directory-kill-chain

Full kill-chain pentest against GOAD — AS-REP roasting, Kerberoasting, constrained-delegation abuse, DCSync and Golden Ticket. Three independent paths to Domain Admin on north.sevenkingdoms.local. 41 findings mapped to MITRE ATT&CK with detection signals and mitigations. Graduation thesis.

silentspike /netbird-machine-tunnel

NetBird fork adding Windows pre-login Machine Tunnel for Active Directory and Kerberos environments using mTLS machine certificates.

eyouel-cloud /ActiveDirectory-CertificateServices

Internal PKI lab using AD Certificate Services with certificate templates, HTTPS binding in IIS, and automated trust for domain clients.

BackdoorAli /Active-Directory-Exploitation-Educational-Guide

Educational Active Directory exploitation and defence guide covering enumeration, credential access, privilege escalation, lateral movement, persistence, detection and hardening.

DaliaBasa /Active-Directory

A simple explanation covering Active Directory from a macro/high-level overview.

TheOmnilord /ADCS

PowerShell tools for AD CS and EJBCA/MSAE PKI: bulk template validity updates (SC-081), batch CSR submission (.req/.csr/.pem or any PKCS #10 file) with resume-safe tracking, cross-forest template sync (target needs no CA), and offline CEP setup per machine or via GPO. Field-validated with EJBCA; Pester-tested on PowerShell 5.1 & 7.

NoMoreFood /craft

Linux Kerberos TGTs via PKINIT with AD CS enrollment or AD Credential Linking (Key Trust), or Windows-exported certificates. Automatic Ticket Renewal

CyberAlp0 /dangling-template-esc

Weaponize a dangling AD CS certificate template via CreateChild rights — create the missing template object preconfigured for ESC1 (ENROLLEE_SUPPLIES_SUBJECT + Client Auth + custom enrollment ACL).

Thafundraiser007 /Windows-Server-AD-CS-Certificate-Lifecycle-Lab

Windows Server lab demonstrating AD CS Enterprise Root CA deployment, certificate templates, GPO auto-enrollment, certificate revocation and CRL validation, and Web Enrollment.

moscowchill /ADCSAudit

Single-file, dependency-free PowerShell auditor for Active Directory Certificate Services (AD CS) ESC misconfigurations. Read-only; run it straight from a domain-joined management server.

Mvrcoz /PKI-Lab-Windows-Server

Deployed a standalone Root CA on Windows Server 2012 R2 using AD CS. PKI configuration with production trade-off analysis

4625tracker /ADCS-CDBRP-Provider

Native COM revocation provider for AD CS Online Responder that answers OCSP from a snapshot of the CA certificate database instead of a CRL — revocation shows up in about a minute, with no CRL publication cycle. Bilingual UI, multi-CA, x64/x86/ARM64.

jakehildreth /blog

My blog.

sarabelinformatika /windows-server-active-directory-hardening

Enterprise hardening guide for Windows Server 2022/2025 and Active Directory, covering privileged access, Windows LAPS, Kerberos, LDAP, Group Policy, auditing, AD CS, backup, and forest recovery.

marky224 /windows-ad-ansible-kvm

Two-site MSP-style Active Directory forest as Ansible IaC on KVM/libvirt: Server 2025 DCs, Win 11 + Ubuntu members, cross-site replication, DHCP failover, and rehearsed DR.