# Microsoft ADCS and Max Path Length for Sub CAs If you are using Microsoft AD Certificate Services as a certificate authority, you may be looking for a way to configure the "acceptable" maximum path length for intermediate CAs (or "sub CAs") issued by your CA. By default, if you are using the “Subordonate Certificate Authority” certificate template, you will see that the basic constraints UI has two checkboxes. The second one is the one that interests us: ``` • Do not allow subject to issue certificates to other CAs ``` ![](https://hackmd.io/_uploads/Sylo-iIwkg.png) When checked, the issued CA will have a max path len of 0. When unchecked, the issued CA will not have the max path len field configured.