Here I am focusing on Enumeration related to AD CS
certipy find -u '[email protected]' -p <password> -dc-ip <DC_IP> -vulnerable -enabled
net group "Cert Publishers" /domain
crackmapexec ldap 'domaincontroller' -d 'domain' -u 'user' -p 'password' -M adcs