In Windows certificate store, an intermediate CA certificate without Key Usage extension is considered eligible (as long as it has isCA flag from Basic Constraints of course) for singing end entity certificates (such chain is considered valid). But, RFC 5280 states that
220.127.116.11. Key Usage
Conforming CAs MUST include this extension in certificates that contain public keys that are used to validate digital signatures on other public key certificates or CRLs. When present, conforming CAs SHOULD mark this extension as critical.
My understanding is that an absence of the Key Usage ext. is an inability of the intermediate CA certificate to sign other certificates. Is this a bug in Windows' validation chain procedure or my misunderstanding of RFC?