Windows Event ID 4880 – Security: Certificate Services Template Security Permissions Changed

Start by examining the specific details of the Event ID 4880 to understand what template and permissions were modified.

1. Open Event Viewer → Windows Logs → Security
2. Filter for Event ID 4880 using the filter option
3. Double-click the event to view detailed information
4. Note the following key fields:
   • Subject: User account that made the change
   • Template Name: Certificate template that was modified
   • Old Security Descriptor: Previous permissions in SDDL format
   • New Security Descriptor: Updated permissions in SDDL format
5. Use PowerShell to query recent events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4880} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Investigate the current state of certificate template permissions to validate the changes and ensure they align with security policies.

1. Open Certificate Templates MMC snap-in:

   certtmpl.msc

2. Locate the affected certificate template from the event
3. Right-click the template → Properties → Security tab
4. Review current permissions and compare with your security baseline
5. Use PowerShell to export current template permissions:

   $template = Get-CATemplate -Name "YourTemplateName"
   $template | Select-Object Name, SecurityDescriptor | Export-Csv -Path "C:\Temp\TemplatePermissions.csv"

6. Query all certificate templates and their permissions:

   Get-ADObject -Filter {objectClass -eq "pKICertificateTemplate"} -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,$((Get-ADDomain).DistinguishedName)" -Properties nTSecurityDescriptor | Select-Object Name, nTSecurityDescriptor

Cross-reference Event ID 4880 with other security events to build a complete picture of the administrative session and validate legitimacy.

1. Search for related logon events around the same timeframe:

   $startTime = (Get-Date).AddHours(-2)
   $endTime = Get-Date
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625,4648; StartTime=$startTime; EndTime=$endTime} | Where-Object {$_.Message -like "*username_from_4880*"}

2. Look for Event ID 4719 (System audit policy changes) that might indicate broader security modifications
3. Check for Event ID 4670 (Permissions on an object were changed) for related Active Directory permission changes
4. Review Certificate Services operational logs:

   Get-WinEvent -LogName "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational" -MaxEvents 100

5. Query for certificate enrollment events (Event ID 4886, 4887) to see if the permission changes affected certificate issuance
6. Check domain controller logs for Active Directory replication events related to the Certificate Templates container

Perform comprehensive validation of your PKI security configuration to ensure the template permission changes maintain proper security boundaries.

1. Audit all certificate template permissions using PowerShell:

   $configDN = "CN=Configuration," + (Get-ADDomain).DistinguishedName
   $templatesDN = "CN=Certificate Templates,CN=Public Key Services,CN=Services," + $configDN
   Get-ADObject -Filter {objectClass -eq "pKICertificateTemplate"} -SearchBase $templatesDN -Properties displayName, nTSecurityDescriptor | ForEach-Object {
       Write-Host "Template: $($_.displayName)"
       $_.nTSecurityDescriptor.Access | Format-Table IdentityReference, AccessControlType, ActiveDirectoryRights
   }

2. Check for overprivileged template permissions that could allow unauthorized certificate enrollment
3. Validate that sensitive templates (like code signing or administrator authentication) have appropriate restrictions
4. Review Certificate Authority security settings:

   certlm.msc

   Navigate to Certificate Authority → Properties → Security
5. Generate a PKI security report:

   PKIView.msc

6. Test certificate enrollment with affected templates to ensure functionality wasn't broken by permission changes

Establish comprehensive monitoring and alerting for certificate template permission changes to detect unauthorized modifications quickly.

1. Create a PowerShell script for continuous monitoring:

   Register-WmiEvent -Query "SELECT * FROM __InstanceModificationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.LogFile = 'Security' AND TargetInstance.EventCode = 4880" -Action {
       $event = $Event.SourceEventArgs.NewEvent.TargetInstance
       Send-MailMessage -To "admin@company.com" -From "pki-monitor@company.com" -Subject "PKI Template Permission Change Detected" -Body $event.Message -SmtpServer "mail.company.com"
   }

2. Configure Windows Event Forwarding (WEF) to centralize PKI audit events from all domain controllers and CA servers
3. Set up custom Event Viewer views for PKI-related events:

   <QueryList>
     <Query Id="0" Path="Security">
       <Select Path="Security">*[System[(EventID=4880 or EventID=4886 or EventID=4887)]]</Select>
     </Query>
   </QueryList>

4. Implement SIEM integration to correlate PKI events with other security activities
5. Create automated response workflows for unauthorized template modifications
6. Establish baseline monitoring using Group Policy to track template permission changes:
   Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Object Access → Audit Certification Services