Windows Event ID 4877 – Security-Auditing: Certificate Services Template Security Permissions Changed

Start by examining the specific details of the Event 4877 occurrence to understand what changed and who made the modification.

1. Open Event Viewer on your domain controller or CA server

2. Navigate to Windows Logs → Security

3. Filter for Event ID 4877 using the following PowerShell command:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4877} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

4. Double-click the event to view detailed information including:

• Subject: Account that made the permission change
• Object: Certificate template that was modified
• Access Request Information: Specific permissions that changed
• Process Information: Application or service that initiated the change

5. Cross-reference the timestamp with any scheduled maintenance or administrative activities to determine if the change was authorized.

Use PowerShell to examine the current permissions on the affected certificate template and compare them with your baseline configuration.

1. Connect to your Certificate Authority server and run:

# Get all certificate templates and their permissions
Get-CATemplate | ForEach-Object {
    $template = $_
    Write-Host "Template: $($template.Name)" -ForegroundColor Green
    Get-ADObject -Identity $template.DistinguishedName -Properties nTSecurityDescriptor | 
    Select-Object -ExpandProperty nTSecurityDescriptor | 
    Select-Object -ExpandProperty Access
}

2. For a specific template mentioned in Event 4877, run:

# Replace 'TemplateName' with the actual template from the event
$templateName = "WebServer"
$template = Get-CATemplate -Name $templateName
Get-ADObject -Identity $template.DistinguishedName -Properties nTSecurityDescriptor

3. Compare current permissions with your documented baseline using:

# Export current permissions for comparison
$acl = Get-ADObject -Identity $template.DistinguishedName -Properties nTSecurityDescriptor
$acl.nTSecurityDescriptor.Access | Export-Csv -Path "C:\Temp\Template_Permissions_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

4. Review the exported permissions against your PKI security policy to identify unauthorized changes.

Leverage Windows Advanced Audit Policy to get comprehensive details about the certificate template permission changes.

1. Verify that certificate services auditing is enabled:

# Check current audit policy settings
auditpol /get /subcategory:"Certification Services" /r

2. If not enabled, configure auditing for certificate services:

# Enable certificate services auditing
auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable

3. Query related security events around the time of Event 4877:

# Get related certificate services events
$startTime = (Get-Date).AddHours(-2)
$endTime = (Get-Date).AddHours(2)
Get-WinEvent -FilterHashtable @{
    LogName='Security'
    Id=4876,4877,4878,4879,4880,4881,4882,4883,4884,4885,4886,4887,4888,4889,4890,4891,4892,4893,4894,4895,4896,4897,4898
    StartTime=$startTime
    EndTime=$endTime
} | Sort-Object TimeCreated

4. Analyze the sequence of events to understand the complete context of the permission change.

Investigate whether the certificate template permission change was part of broader Active Directory modifications or security group changes.

1. Check for related Active Directory events:

# Look for AD object modifications around the same time
$eventTime = (Get-Date "2026-03-18 14:30:00") # Replace with actual event time
$timeWindow = 30 # minutes
Get-WinEvent -FilterHashtable @{
    LogName='Security'
    Id=5136,5137,5138,5139,5141
    StartTime=$eventTime.AddMinutes(-$timeWindow)
    EndTime=$eventTime.AddMinutes($timeWindow)
} | Where-Object {$_.Message -like "*CN=Certificate Templates*"}

2. Examine group membership changes that might affect template permissions:

# Check for group membership modifications
Get-WinEvent -FilterHashtable @{
    LogName='Security'
    Id=4728,4729,4732,4733,4756,4757
    StartTime=$eventTime.AddMinutes(-$timeWindow)
    EndTime=$eventTime.AddMinutes($timeWindow)
}

3. Review the Configuration partition for certificate template objects:

# Query certificate templates in AD Configuration partition
$configDN = (Get-ADRootDSE).configurationNamingContext
Get-ADObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,$configDN" -Filter * -Properties whenChanged, whenCreated | Sort-Object whenChanged -Descending

4. Document the correlation between AD changes and certificate template permission modifications for your security incident report.

Set up proactive monitoring to detect future unauthorized certificate template permission changes and establish baseline security configurations.

1. Create a PowerShell script for continuous monitoring:

# Certificate Template Permission Monitor Script
$logName = "Security"
$eventId = 4877
$lastCheck = (Get-Date).AddMinutes(-5)

# Get recent Event 4877 occurrences
$events = Get-WinEvent -FilterHashtable @{
    LogName=$logName
    Id=$eventId
    StartTime=$lastCheck
} -ErrorAction SilentlyContinue

foreach ($event in $events) {
    $eventXML = [xml]$event.ToXml()
    $subject = $eventXML.Event.EventData.Data | Where-Object {$_.Name -eq "SubjectUserName"} | Select-Object -ExpandProperty "#text"
    $templateName = $eventXML.Event.EventData.Data | Where-Object {$_.Name -eq "ObjectName"} | Select-Object -ExpandProperty "#text"
    
    # Send alert (customize for your environment)
    Write-Warning "Certificate template permission change detected: Template=$templateName, User=$subject, Time=$($event.TimeCreated)"
}

2. Schedule the monitoring script using Task Scheduler:

# Create scheduled task for monitoring
$action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\Monitor-CertTemplatePermissions.ps1"
$trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Minutes 5) -RepetitionDuration (New-TimeSpan -Days 365) -At (Get-Date)
$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
Register-ScheduledTask -TaskName "Certificate Template Permission Monitor" -Action $action -Trigger $trigger -Settings $settings -User "SYSTEM"

3. Establish baseline template permissions and store them securely:

# Create baseline of all certificate template permissions
$baseline = @{}
Get-CATemplate | ForEach-Object {
    $template = $_
    $permissions = Get-ADObject -Identity $template.DistinguishedName -Properties nTSecurityDescriptor
    $baseline[$template.Name] = $permissions.nTSecurityDescriptor.Sddl
}
$baseline | ConvertTo-Json | Out-File "C:\PKI\Baseline\CertTemplate_Permissions_Baseline_$(Get-Date -Format 'yyyyMMdd').json"