Certificate Services approved and issued a certificate

What it means

The certificate was issued. If it names an admin but went to someone else, the attacker can log in as that admin (ESC1) — even after a password reset.

First steps

1. 1Check the SAN against the requester — a mismatch means investigate now.
2. 2Revoke the suspicious certificate in the certsrv.msc console.
3. 3Look for 4768 with certificate (PKINIT) auth from the same account.