Locksmith for finding and fixing AD CS misconfigurations

Locksmith's AD CS operating scope

Locksmith addresses a specific infrastructure problem: administrators need to inspect Active Directory Certificate Services configurations across an Active Directory forest and identify conditions that the tool knows how to remediate. It is not a general certificate inventory, a certificate lifecycle manager, or a replacement for monitoring PKI operations. Its scope is the AD CS environment and the list of misconfigurations implemented by the project.

The repository provides two distribution forms. The PowerShell module contains `Locksmith.psd1`, `Locksmith.psm1`, and supporting directories, while `Invoke-Locksmith.ps1` provides the standalone script form. The README also links to downloadable module and monolithic script archives in the GitHub releases section. This packaging gives administrators a choice between importing a reusable module and running a self-contained script.

Locksmith must run on a domain-joined system. The `ActiveDirectory` and `ServerManager` PowerShell modules must be installed before the Locksmith module is imported. Administrative rights may be required for some checks and for remediation. Those prerequisites make the project an internal administration tool rather than something that can be evaluated on an arbitrary laptop with no directory relationship to the target forest.

How Locksmith scans an Active Directory forest

The central entry point is `Invoke-Locksmith`. According to the README, the tool scans the current Active Directory forest and reports discovered AD CS issues. The scan set is selectable with the `-Scans` parameter. The documented values are `All`, `Auditing`, `ESC1`, `ESC2`, `ESC3`, `ESC4`, `ESC5`, `ESC6`, `ESC7`, `ESC8`, `ESC9`, `ESC11`, `ESC13`, `ESC15`, `EKEUwu`, `ESC16`, and `PromptMe`.

`All` requests the full documented scan set. `PromptMe` presents an interactive list from which the operator selects one or more scans. The named ESC scans provide a more focused way to inspect particular issue categories, while `Auditing` is documented as a scan option in its own right. The README does not describe the internal data access for each scan, so the exact directory queries or certificates inspected by every check cannot be confirmed from the available documentation.

The output mode controls presentation, not the core detection subject. Modes 0 and 1 write results to the console. Modes 2 and 3 create CSV files. Mode 4 changes the purpose from diagnosis alone to proposed remediation. Locksmith also warns when a possible fix could have operational impact, although the README does not define a rollback mechanism or document how to undo a completed change.

Installing Locksmith and checking a forest

The shortest documented installation uses the PowerShell Gallery. Run this from PowerShell on a domain-joined system after confirming that the prerequisite modules are available:

Install-Module -Name Locksmith -Scope CurrentUser

After installation, the module form is invoked with `Invoke-Locksmith`. With no parameters, or with `-Mode 0`, it scans the current forest and displays discovered AD CS issues in Table format. This is the least invasive documented starting point because it is an identification mode and does not request fixes:

Invoke-Locksmith

The README also documents downloading a release archive and importing the module from the extracted directory. The archive contains a `Locksmith.psd1`, so the import target is explicit rather than dependent on a system-wide module path:

Unblock-File .\Locksmith.zip
Expand-Archive .\Locksmith.zip
Import-Module .\Locksmith\Locksmith.psd1
Invoke-Locksmith

Run these commands from the directory containing the downloaded archive. The documented standalone alternative expands `Invoke-Locksmith.zip` and runs the extracted `Invoke-Locksmith.ps1`. No installation command should be copied to a non-domain-joined host expecting a local scan, because the README states that the tool must run on a domain-joined system.

Selecting AD CS scans with Locksmith

The `-Scans` parameter lets an operator avoid requesting the entire scan set. The README gives `PromptMe` as the interactive option, which is useful when the intended review needs to be narrowed before execution:

Invoke-Locksmith.ps1 -Scans PromptMe

The example uses script syntax. In a module installation, the same documented parameter is shown with the module command:

Invoke-Locksmith -Scan All

The README text and the example use different spellings here: the prose identifies the parameter as `-Scans`, while the all-scans example uses `-Scan All`. Because PowerShell parameter spelling matters, an operator should check the installed command's parameter syntax before copying that example. The repository's documented scan values remain the safer basis for selecting a focused run once the accepted parameter name is confirmed.

The available values cover issue classes rather than individual hosts or certificates. Locksmith therefore works at the forest scan level described by the project. It does not document a host filter, certificate filter, date range, exclusion list, or remediation preview command in the README. Those omissions limit how precisely an administrator can scope a run without first understanding the module implementation.

Reading console, CSV, and remediation output

Mode 1 adds possible fixes to the console report and changes the display format to List format. It remains an identification-and-guidance workflow, so it is more useful when an administrator needs to see proposed actions before deciding whether to request remediation:

Invoke-Locksmith -Mode 1

Mode 2 scans the current forest and writes discovered issues to `ADCSIssues.CSV` in the present working directory. Mode 3 adds example fixes and writes `ADCSRemediation.CSV` in that directory:

Invoke-Locksmith -Mode 2

Invoke-Locksmith -Mode 3

The filenames are fixed by the documentation. Because output is written to the current directory rather than an explicitly supplied path, the administrator should confirm the working directory before running Modes 2 or 3. The README says that Mode 3 contains example fixes, not that it applies them. Mode 4 is the documented command that identifies misconfigurations and offers to fix each issue.

CSV output can be useful when findings must be routed to another administrative process or reviewed outside the console. However, the README does not specify the CSV schema, encoding, ordering, or whether files are overwritten. Those details should be confirmed from the generated file or project source before depending on an automated parser.

Mode 4's remediation boundary

Mode 4 is the highest-impact documented mode:

Invoke-Locksmith -Mode 4

The README describes it as identifying misconfigurations and offering to fix each issue. It also warns when a possible operational impact exists. That wording matters. The command is interactive because it offers fixes, but the README does not state whether every change requires a separate confirmation prompt, whether one confirmation can apply multiple fixes, or whether a dry-run option exists. It also does not document a rollback command.

Locksmith should therefore not be treated as an automated configuration-management module. The tool is aimed at an administrator who can inspect findings and make decisions while the command is running. A deployment where changes must be approved through an external change system, applied non-interactively, or reverted through a tested procedure would need additional controls and information not supplied by the README.

There is another boundary: the tool handles misconfigurations covered by its implemented scans. It does not claim to validate every PKI design decision, certificate template permission issue, private key exposure, enrollment policy problem, or operational health concern. A clean report from a supported scan is not documented as proof that the entire certificate authority is correctly configured.

Maintenance, licensing, and upgrade considerations

The repository is not archived. Its last push was on 2026-10-03, and the recent release history includes `v2025.9.8` from 2025-09-11, `v2025.5.26` from 2025-05-26, and `v2025.4.20` from 2025-04-21. Those facts indicate recent repository activity, but the README does not provide a compatibility policy for particular Windows Server or PowerShell versions.

Upgrading a PowerShell module can change the checks, remediation behavior, and output format. The release archive route also creates a separate operational question: whether an administrator uses Gallery installation or downloads a named release archive. The available documentation does not state how to pin a version for stable deployments or how to compare scan definitions between releases. Administrators using Locksmith in change windows should record the installed module version and retain the release-specific outputs.

The repository identifies its license as a custom license that GitHub cannot classify. The available project information does not reproduce the terms, so it does not establish redistribution rights, internal-use rights, or obligations for a modified copy. The `LICENSE` file must be reviewed before copying, redistributing, or incorporating the module into another package. The `SECURITY.md`, `SUPPORT.md`, `CONTRIBUTING.md`, and `Tests/` directories are present in the repository, but the README does not document their contents.

Editorial conclusion

Locksmith is appropriate for domain-joined administrators who need a documented PowerShell workflow for assessing and remediating common AD CS configurations. It is unsuitable for non-Windows systems, systems without the required modules, or operators who require an unattended and fully configurable remediation policy. Before using Mode 4, verify the reported findings, review the possible operational impact, and confirm that the current user has the permissions required by the environment.

Frequently asked questions

Official sources

1. Issues
2. jakehildreth/Locksmith on GitHub
3. Project website
4. README
5. Releases