ADCS Private Key

Question

Hi all,

Private Key of Root CA/Subordinate CA can be exported when using a local administrator to do backup of the CA.

I have tried exporting the private key myself, however, there is no windows event log generated for me to detect when someone is exporting the private key.

May I know what protection can be implement to protect ADCS private key ?

Thanks in advance!

Answer 1

By default, Windows does not log private key exports even when performed by an administrator. That’s a design limitation — exporting a private key from the Windows certificate store doesn’t generate a specific Windows Event Log, unless additional auditing or security tools are enabled.

To mitigate potential risks, consider the following options:

1. Enable role separation in ADCS between users who manage the CA and those who request/issue certificates.
2. Minimize the number of users who are local administrators on the CA server. Use Just Enough Administration (JEA) or Privileged Access Workstations (PAWs).
3. Apply additional auditing and logging.

• Enable Audit Object Access in Group Policy.
• Enable "Audit Certification Services" logs.

4. Monitor with EDR/XDR Tools. Modern Endpoint Detection and Response (EDR) tools (e.g., Microsoft Defender for Endpoint) can detect unusual behaviors:

• Access to MachineKeys directory
• Use of certutil or other certificate tools
• Suspicious command-line activity like certutil -exportPFX

More at https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn786426(v=ws.11)

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin