ntlmrelayx and ADCS: when the certificate arrives but doesn't work
ADCS relay with ntlmrelayx generates certificates that certipy v5 rejects with ‘Object SID mismatch’. The root cause is KB5014754: modern DCs require the certificate to contain the user’s SID in a Microsoft-proprietary extension. ntlmrelayx doesn’t include it. Here’s why and how to fix it.