detection.wiki

Microsoft-Windows-CertificationAuthority › Event 53

Event ID 53 — Active Directory Certificate Services denied request Name because RequestId.

Provider
Microsoft-Windows-CertificationAuthority
Channel
Application
Level
Warning

Description

Active Directory Certificate Services denied request Name because RequestId. The request was for Reason. Additional information: SubjectName.

Message #

Active Directory Certificate Services denied request %1 because %2.  The request was for %3.  Additional information: %4

Fields #

NameDescription
Name—
RequestId UnicodeString—
Reason UnicodeString—
SubjectName UnicodeString—
AdditionalInformation UnicodeString—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CertificationAuthority",
    "guid": "6A71D062-9AFE-4F35-AD08-52134F85DFB9",
    "event_source_name": "",
    "event_id": 53,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:16:58.388339+00:00",
    "event_record_id": 3704,
    "correlation": {},
    "execution": {
      "process_id": 9432,
      "thread_id": 10184
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "MSG_DN_CERT_DENIED_WITH_INFO",
    "RequestId": "2",
    "Reason": "The request contains no certificate template information. 0x80094801 (-2146875391 CERTSRV_E_NO_CERT_TYPE)",
    "SubjectName": "CN=EvtGenTestCert, O=Test, L=Test, S=Test, C=US",
    "AdditionalInformation": "Denied by Policy Module  0x80094801, The request does not contain a certificate template extension or the CertificateTemplate request attribute.\r\n"
  },
  "message": ""
}

Detection Rules #

View all rules referencing this event →

Sigma # view in reference