# Understanding the ms_pki_enrollment_flag in Doom: Active Directory Certificate Template Analysis

> Discover the ms_pki_enrollment_flag within Doom's Active Directory Certificate Template analysis. Understand how this LDAP bit-mask controls certificate enrollment and view its decoded security properties.

- Repository: [000pp/doom](https://github.com/000pp/doom)
- Tags: deep-dive
- Published: 2026-02-22

---

**The `ms_pki_enrollment_flag` is an LDAP bit-mask attribute that controls certificate enrollment behaviors, which Doom decodes into human-readable security properties when enumerating Active Directory Certificate Templates.**

The `ms_pki_enrollment_flag` attribute is critical for understanding certificate template security configurations in Active Directory. In the 000pp/doom repository, this attribute is parsed to reveal enrollment restrictions, approval requirements, and automatic enrollment capabilities. Doom translates the raw bit-mask into actionable intelligence for security assessments by mapping specific bits to their functional meanings.

## What Is the msPKI-Enrollment-Flag Attribute?

`msPKI-Enrollment-Flag` is an LDAP attribute stored on Certificate Template objects in Active Directory. It contains a 32-bit integer acting as a bit-mask that instructs the Certificate Services engine which special behaviors apply during certificate enrollment. Each bit represents a specific enrollment requirement or capability, such as requiring manager approval, enabling auto-enrollment, or allowing enrollment on behalf of other principals.

When Doom enumerates certificate templates via [`src/doom/modules/enumerate_templates.py`](https://github.com/000pp/doom/blob/main/src/doom/modules/enumerate_templates.py), it extracts this attribute and expands the bit-mask into a set of boolean properties. If the attribute is missing or zero, Doom reports the enrollment flags as **None**.

## How Doom Interprets Enrollment Flags

### Template Enumeration Logic

In [`src/doom/modules/enumerate_templates.py`](https://github.com/000pp/doom/blob/main/src/doom/modules/enumerate_templates.py) (lines 60-76), Doom retrieves the raw LDAP attributes for each certificate template. The code extracts the `msPKI-Enrollment-Flag` value and applies bitwise operations to determine which enrollment behaviors are enabled. This logic converts the numeric bit-mask into a dictionary of named boolean flags that represent the template's enrollment constraints.

### Flag Parsing and Display

The [`src/doom/parsers/attribute.py`](https://github.com/000pp/doom/blob/main/src/doom/parsers/attribute.py) file (lines 14-18) handles the final formatting of these flags for CLI output. The parser iterates over the defined bit constants, appending the human-readable flag name to the output list when the corresponding bit is set in the enrollment flag value. This transformation allows security analysts to immediately identify risky configurations like `Auto_Enrollment` combined with `Domain_Auth_Not_Required`.

## Bit Mask Reference: Enrollment Flag Values

Doom maps the following bit values according to the constants defined in [`src/doom/parsers/certipy/constants.py`](https://github.com/000pp/doom/blob/main/src/doom/parsers/certipy/constants.py) (lines 145-224):

| Bit (hex) | Flag Name | Description |
|-----------|-----------|-------------|
| `0x00000001` | **Include_Symmetric_Algorithms** | Permits symmetric-key algorithms in the certificate |
| `0x00000002` | **Requires_Manager_Approval** | Requires a manager to approve the enrollment request |
| `0x00000008` | **Publish_To_DS** | Publishes the issued certificate back to Active Directory |
| `0x00000010` | **Check_DS_Before_Auto_Enrollment** | Checks for existing certificates before auto-enrolling |
| `0x00000020` | **Auto_Enrollment** | Enables automatic certificate enrollment for the template |
| `0x00000040` | **Validate_Reenrollment** | Requires approval when re-requesting a certificate |
| `0x00000080` | **Domain_Auth_Not_Required** | Allows enrollment without domain authentication |
| `0x00000100` | **User_Interaction_Required** | Requires UI interaction (e.g., PIN entry) during enrollment |
| `0x00000800` | **Allow_Enroll_On_Behalf_Of** | Permits requesting certificates on behalf of other principals |

## Implementation Details: From LDAP to Output

When processing a certificate template, Doom extracts the enrollment flag using bitwise AND operations to test for specific bits:

```python

# Extracting the flag value from an LDAP entry (from enumerate_templates.py)

raw_attributes = entry.get_attributes()
enrollment_flag = raw_attributes.get('msPKI-Enrollment-Flag', 0)

# Converting the bit-mask into boolean properties

properties = {
    "Requires_Manager_Approval": bool(enrollment_flag & 0x00000002),
    "Auto_Enrollment":            bool(enrollment_flag & 0x00000020),
    "User_Interaction_Required":  bool(enrollment_flag & 0x00000100),
    "Publish_To_DS":              bool(enrollment_flag & 0x00000008),
    "Domain_Auth_Not_Required":   bool(enrollment_flag & 0x00000080),
    "Allow_Enroll_On_Behalf_Of":  bool(enrollment_flag & 0x00000800),
    "Include_Symmetric_Algorithms": bool(enrollment_flag & 0x00000001),
}

```

The CLI output displays these flags as a comma-separated list:

```bash

# Doom CLI output excerpt

Template:   WebServer
Enrollment Flags: Auto_Enrollment, User_Interaction_Required, Publish_To_DS

```

For additional context on enrollment data structures, [`src/doom/parsers/certipy/structs.py`](https://github.com/000pp/doom/blob/main/src/doom/parsers/certipy/structs.py) (line 624) contains ASN.1 definitions used during certificate enrollment request processing.

## Summary

- The `ms_pki_enrollment_flag` is a bit-mask LDAP attribute on AD Certificate Templates that controls enrollment behavior.
- Doom parses this attribute in [`enumerate_templates.py`](https://github.com/000pp/doom/blob/main/enumerate_templates.py) using bitwise operations to detect specific security settings.
- The [`attribute.py`](https://github.com/000pp/doom/blob/main/attribute.py) parser converts detected bits into human-readable flag names for CLI display.
- Key security-relevant bits include `Requires_Manager_Approval` (0x00000002), `Auto_Enrollment` (0x00000020), and `Domain_Auth_Not_Required` (0x00000080).
- Flag constants and documentation are maintained in [`src/doom/parsers/certipy/constants.py`](https://github.com/000pp/doom/blob/main/src/doom/parsers/certipy/constants.py).

## Frequently Asked Questions

### What does the ms_pki_enrollment_flag control in Active Directory?

The attribute controls specialized behaviors during certificate enrollment, such as whether a certificate request requires manager approval, if the certificate should be published back to the directory, or whether the template supports automatic enrollment without user intervention. Each bit in the mask represents a distinct enrollment policy that Certificate Services enforces when processing requests.

### How does Doom convert the bit-mask to readable output?

Doom applies bitwise AND operations between the enrollment flag integer and defined hex constants (located in [`src/doom/parsers/certipy/constants.py`](https://github.com/000pp/doom/blob/main/src/doom/parsers/certipy/constants.py)). When a bit match returns true, the corresponding flag name is added to a list. The [`src/doom/parsers/attribute.py`](https://github.com/000pp/doom/blob/main/src/doom/parsers/attribute.py) module then formats this list for display, showing "None" if no bits are set.

### Which enrollment flag bit indicates automatic enrollment support?

The `Auto_Enrollment` flag corresponds to bit `0x00000020`. When this bit is set in the `msPKI-Enrollment-Flag` attribute, the certificate template supports automatic enrollment, allowing systems or users to receive certificates without manually initiating the request, provided other requirements like `Domain_Auth_Not_Required` are also met.

### Where does Doom define the constants for these flag values?

Doom defines the enrollment flag constants and their documentation in [`src/doom/parsers/certipy/constants.py`](https://github.com/000pp/doom/blob/main/src/doom/parsers/certipy/constants.py) between lines 145-224. These constants map hex values to semantic names like `Requires_Manager_Approval` and `Allow_Enroll_On_Behalf_Of`, ensuring consistent interpretation across the codebase.