Understanding the ms_pki_enrollment_flag in Doom: Active Directory Certificate Template Analysis

The ms_pki_enrollment_flag is an LDAP bit-mask attribute that controls certificate enrollment behaviors, which Doom decodes into human-readable security properties when enumerating Active Directory Certificate Templates.

The ms_pki_enrollment_flag attribute is critical for understanding certificate template security configurations in Active Directory. In the 000pp/doom repository, this attribute is parsed to reveal enrollment restrictions, approval requirements, and automatic enrollment capabilities. Doom translates the raw bit-mask into actionable intelligence for security assessments by mapping specific bits to their functional meanings.

What Is the msPKI-Enrollment-Flag Attribute?

msPKI-Enrollment-Flag is an LDAP attribute stored on Certificate Template objects in Active Directory. It contains a 32-bit integer acting as a bit-mask that instructs the Certificate Services engine which special behaviors apply during certificate enrollment. Each bit represents a specific enrollment requirement or capability, such as requiring manager approval, enabling auto-enrollment, or allowing enrollment on behalf of other principals.

When Doom enumerates certificate templates via src/doom/modules/enumerate_templates.py, it extracts this attribute and expands the bit-mask into a set of boolean properties. If the attribute is missing or zero, Doom reports the enrollment flags as None.

How Doom Interprets Enrollment Flags

Template Enumeration Logic

In src/doom/modules/enumerate_templates.py (lines 60-76), Doom retrieves the raw LDAP attributes for each certificate template. The code extracts the msPKI-Enrollment-Flag value and applies bitwise operations to determine which enrollment behaviors are enabled. This logic converts the numeric bit-mask into a dictionary of named boolean flags that represent the template's enrollment constraints.

Flag Parsing and Display

The src/doom/parsers/attribute.py file (lines 14-18) handles the final formatting of these flags for CLI output. The parser iterates over the defined bit constants, appending the human-readable flag name to the output list when the corresponding bit is set in the enrollment flag value. This transformation allows security analysts to immediately identify risky configurations like Auto_Enrollment combined with Domain_Auth_Not_Required.

Bit Mask Reference: Enrollment Flag Values

Doom maps the following bit values according to the constants defined in src/doom/parsers/certipy/constants.py (lines 145-224):

Bit (hex)	Flag Name	Description
0x00000001	Include_Symmetric_Algorithms	Permits symmetric-key algorithms in the certificate
0x00000002	Requires_Manager_Approval	Requires a manager to approve the enrollment request
0x00000008	Publish_To_DS	Publishes the issued certificate back to Active Directory
0x00000010	Check_DS_Before_Auto_Enrollment	Checks for existing certificates before auto-enrolling
0x00000020	Auto_Enrollment	Enables automatic certificate enrollment for the template
0x00000040	Validate_Reenrollment	Requires approval when re-requesting a certificate
0x00000080	Domain_Auth_Not_Required	Allows enrollment without domain authentication
0x00000100	User_Interaction_Required	Requires UI interaction (e.g., PIN entry) during enrollment
0x00000800	Allow_Enroll_On_Behalf_Of	Permits requesting certificates on behalf of other principals

Implementation Details: From LDAP to Output

When processing a certificate template, Doom extracts the enrollment flag using bitwise AND operations to test for specific bits:

# Extracting the flag value from an LDAP entry (from enumerate_templates.py)

raw_attributes = entry.get_attributes()
enrollment_flag = raw_attributes.get('msPKI-Enrollment-Flag', 0)

# Converting the bit-mask into boolean properties

properties = {
    "Requires_Manager_Approval": bool(enrollment_flag & 0x00000002),
    "Auto_Enrollment":            bool(enrollment_flag & 0x00000020),
    "User_Interaction_Required":  bool(enrollment_flag & 0x00000100),
    "Publish_To_DS":              bool(enrollment_flag & 0x00000008),
    "Domain_Auth_Not_Required":   bool(enrollment_flag & 0x00000080),
    "Allow_Enroll_On_Behalf_Of":  bool(enrollment_flag & 0x00000800),
    "Include_Symmetric_Algorithms": bool(enrollment_flag & 0x00000001),
}

The CLI output displays these flags as a comma-separated list:

# Doom CLI output excerpt

Template:   WebServer
Enrollment Flags: Auto_Enrollment, User_Interaction_Required, Publish_To_DS

For additional context on enrollment data structures, src/doom/parsers/certipy/structs.py (line 624) contains ASN.1 definitions used during certificate enrollment request processing.

Summary

• The ms_pki_enrollment_flag is a bit-mask LDAP attribute on AD Certificate Templates that controls enrollment behavior.
• Doom parses this attribute in enumerate_templates.py using bitwise operations to detect specific security settings.
• The attribute.py parser converts detected bits into human-readable flag names for CLI display.
• Key security-relevant bits include Requires_Manager_Approval (0x00000002), Auto_Enrollment (0x00000020), and Domain_Auth_Not_Required (0x00000080).
• Flag constants and documentation are maintained in src/doom/parsers/certipy/constants.py.

Frequently Asked Questions

What does the ms_pki_enrollment_flag control in Active Directory?

The attribute controls specialized behaviors during certificate enrollment, such as whether a certificate request requires manager approval, if the certificate should be published back to the directory, or whether the template supports automatic enrollment without user intervention. Each bit in the mask represents a distinct enrollment policy that Certificate Services enforces when processing requests.

How does Doom convert the bit-mask to readable output?

Doom applies bitwise AND operations between the enrollment flag integer and defined hex constants (located in src/doom/parsers/certipy/constants.py). When a bit match returns true, the corresponding flag name is added to a list. The src/doom/parsers/attribute.py module then formats this list for display, showing "None" if no bits are set.

Which enrollment flag bit indicates automatic enrollment support?

The Auto_Enrollment flag corresponds to bit 0x00000020. When this bit is set in the msPKI-Enrollment-Flag attribute, the certificate template supports automatic enrollment, allowing systems or users to receive certificates without manually initiating the request, provided other requirements like Domain_Auth_Not_Required are also met.

Where does Doom define the constants for these flag values?

Doom defines the enrollment flag constants and their documentation in src/doom/parsers/certipy/constants.py between lines 145-224. These constants map hex values to semantic names like Requires_Manager_Approval and Allow_Enroll_On_Behalf_Of, ensuring consistent interpretation across the codebase.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}