![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(3.2, 77%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EEJ%3C/text%3E%3C/svg%3E)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(185.6, 36%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETL%3C/text%3E%3C/svg%3E)
Hello Emily Johnson,
The legacy Active Directory Certificate Services Web Enrolment interface under certsrv is built on outdated ASP components that lack modern security protections. As a result, it regularly fails penetration tests and vulnerability scans, often due to cross‑site scripting issues and NTLM relay exposure. Microsoft advises removing these pages in enterprise environments and moving to Certificate Enrolment Web Services (CES) and Certificate Enrolment Policy Web Services (CEP). These services use secure WCF endpoints over HTTPS and integrate directly with modern Windows clients without relying on interactive web pages.
To retire the old interface, open PowerShell with administrative rights on the host CA or IIS server and run Uninstall‑AdcsWebEnrollment. You can then delete the remaining virtual directory in IIS Manager or remove the legacy certsrv application from the Default Web Site to close the attack surface immediately.
Afterwards, deploy the modern endpoints by running Install‑AdcsEnrollmentPolicyWebService and Install‑AdcsEnrollmentWebService, making sure you bind valid TLS certificates and configure Windows Authentication or Kerberos. If this approach resolves your audit findings and supports your migration, please accept this answer.
Tracy Le.