---
id: 2613
title: "When EPA isn't EPA'ing: What Tools Like Certify, Certipy and checkMSSQLStatus.py miss"
source_domain: abdulmhsblog.com
source_url: "http://abdulmhsblog.com/posts/pitfallswithepa/"
published_at: "2026-06-24 00:00"
tags: ["ai-security", "active-directory", "penetration-testing", "pentest", "adcs", "esc8", "ntlm-relay", "epa", "certipy", "ad-cs"]
phying_url: "https://phying.com/item/2613"
lang: en
---

# When EPA isn't EPA'ing: What Tools Like Certify, Certipy and checkMSSQLStatus.py miss

## Summary

A pentester notes Certify and Certipy can misjudge ESC8 NTLM relay exposure: even with EPA enabled, AD CS Web Enrollment may stay relayable when channel or service binding isn't configured right.

## Intelligence Metadata

- **Sources:** abdulmhsblog.com
- **Published:** 2026-06-24 00:00
- **Original:** http://abdulmhsblog.com/posts/pitfallswithepa/
- **Phying News:** https://phying.com/item/2613