Mitigating NTLM Relay Attacks on Active Directory Certificate Services (Ad CS) (support.microsoft.com)