{"id":24365909,"url":"https://github.com/jakehildreth/Locksmith","last_synced_at":"2025-09-29T02:31:24.402Z","repository":{"id":61484441,"uuid":"486407638","full_name":"jakehildreth/Locksmith","owner":"jakehildreth","description":"A small tool built to find and fix common misconfigurations in Active Directory Certificate Services.","archived":false,"fork":false,"pushed_at":"2025-01-12T17:39:33.000Z","size":1843,"stargazers_count":1000,"open_issues_count":19,"forks_count":93,"subscribers_count":16,"default_branch":"main","last_synced_at":"2025-01-13T17:43:31.402Z","etag":null,"topics":["active-directory","active-directory-certificate-services","ad-cs","adcs","pki","powershell","powershell-module","powershell-script"],"latest_commit_sha":null,"homepage":"https://jakehildreth.github.io/Locksmith/","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jakehildreth.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.MD","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-04-28T01:37:32.000Z","updated_at":"2025-01-13T16:52:31.000Z","dependencies_parsed_at":"2024-04-18T21:23:20.688Z","dependency_job_id":"79405dc7-bda5-4013-92d3-b8dbc85c76a4","html_url":"https://github.com/jakehildreth/Locksmith","commit_stats":{"total_commits":465,"total_committers":14,"mean_commits":"33.214285714285715","dds":0.3139784946236559,"last_synced_commit":"b8878004882b2a369e6186041118425a96040ced"},"previous_names":["jakehildreth/locksmith"],"tags_count":12,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jakehildreth%2FLocksmith","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jakehildreth%2FLocksmith/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jakehildreth%2FLocksmith/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jakehildreth%2FLocksmith/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jakehildreth","download_url":"https://codeload.github.com/jakehildreth/Locksmith/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":234579640,"owners_count":18855639,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["active-directory","active-directory-certificate-services","ad-cs","adcs","pki","powershell","powershell-module","powershell-script"],"created_at":"2025-01-19T00:02:28.512Z","updated_at":"2025-09-29T02:31:24.396Z","avatar_url":"https://github.com/jakehildreth.png","language":"PowerShell","readme":"\u003c!-- markdownlint-disable MD022 --\u003e\n\u003c!-- markdownlint-disable MD033 --\u003e\n# Locksmith\n\n```text\n _       _____  _______ _     _ _______ _______ _____ _______ _     _\n |      |     | |       |____/  |______ |  |  |   |      |    |_____|\n |_____ |_____| |_____  |    \\_ ______| |  |  | __|__    |    |     |\n     .--.                  .--.                  .--.\n    /.-. '----------.     /.-. '----------.     /.-. '----------.\n    \\'-' .---'-''-'-'     \\'-' .--'--''-'-'     \\'-' .--'--'-''-'\n     '--'                  '--'                  '--'\n```\n\nA small tool built to find and fix common misconfigurations in Active Directory Certificate Services.\n\n\u003c!-- locksmith-badges-start --\u003e\n![GitHub release](https://img.shields.io/github/v/release/jakehildreth/locksmith?sort=semver)\n![GitHub top language](https://img.shields.io/github/languages/top/jakehildreth/locksmith)\n![PowerShell Gallery Platform Support](https://img.shields.io/powershellgallery/p/locksmith)\n[![GitHub contributors](https://img.shields.io/github/contributors/jakehildreth/locksmith.svg)](https://github.com/jakehildreth/locksmith/graphs/contributors/)\n[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](http://makeapullrequest.com)\n![GitHub Actions Workflow Status](https://img.shields.io/github/actions/workflow/status/jakehildreth/Locksmith/powershell.yml?logo=github\u0026label=PSScriptAnalyzer)\n![PowerShell Gallery Downloads](https://img.shields.io/powershellgallery/dt/locksmith?logo=powershell\u0026label=PowerShell%20Gallery%20Downloads\u0026color=blue)\n\u003c!-- locksmith-badges-end --\u003e\n\n## Contents\n\n1. [Installation](#installation)\n2. [Run Locksmith](#run-locksmith)\n   1. [Mode 0](#mode-0-identify-issues-output-to-console-default)\n   2. [Mode 1](#mode-1-identify-issues-and-fixes-output-to-console)\n   3. [Mode 2](#mode-2-identify-issues-output-to-csv)\n   4. [Mode 3](#mode-3-identify-issues-and-fixes-output-to-csv)\n   5. [Mode 4](#mode-4-fix-all-issues)\n   6. [Scans](#scans)\n\n\u003ca name=\"installation\" id=\"installation\"\u003e\u003c/a\u003e\n## Installation\n\n### Prerequisites\n\n1. Locksmith must be run on a domain joined system.\n2. The ActiveDirectory and ServerManager PowerShell modules must be installed before importing the Locksmith module.\n3. Administrative rights may be required for some checks and for remediation.\n\n### Standard Module Installation\n\nOpen a PowerShell prompt and install Locksmith from the PowerShell Gallery:\n\n```powershell\nInstall-Module -Name Locksmith -Scope CurrentUser\n```\n\n### Alternative Installation Methods\n\n1. Download and Use the Module Without Installing It\n   1. Download the [latest module version](https://github.com/jakehildreth/Locksmith/releases/latest/download/Locksmith.zip).\n   2. Open a PowerShell prompt to the location of the extracted file and run:\n\n   ```powershell\n   Unblock-File .\\Locksmith.zip # if necessary to unblock the download\n   Expand-Archive .\\Locksmith.zip\n   Import-Module .\\Locksmith\\Locksmith.psd1\n   Invoke-Locksmith\n   ```\n\n2. Download the Standalone Script Without Module\n   1. Download the [latest monolithic (all-in-one) script version](https://github.com/jakehildreth/Locksmith/releases/latest/download/Invoke-Locksmith.zip).\n   2. Open a PowerShell prompt to the location of the downloaded file and run:\n\n   ```powershell\n   Unblock-File .\\Invoke-Locksmith.zip\n   Expand-Archive .\\Invoke-Locksmith.zip -DestinationPath .\\\n   .\\Invoke-Locksmith.ps1\n   ```\n\n\u003ca name=\"run-locksmith\" id=\"run-locksmith\"\u003e\u003c/a\u003e\n## Run Locksmith\n\nThere are several modes you can chose from when running `Invoke-Locksmith`. You can also use the **Scans** parameter to choose which scans you want to invoke.\n\n\u003ca name=\"mode-0-identify-issues-output-to-console-default\" id=\"mode-0-identify-issues-output-to-console-default\"\u003e\u003c/a\u003e\n### Mode 0: Identify Issues, Output to Console (Default)\n\nRunning `Invoke-Locksmith.ps1` with no parameters or with `-Mode 0` will scan the current Active Directory forest and output all discovered AD CS issues to the console in **Table** format.\n\n``` powershell\n# Module Syntax\nInvoke-Locksmith\n```\n\n``` powershell\n# Script Syntax\n.\\Invoke-Locksmith.ps1\n```\n\nExample Output for Mode 0: \u003chttps://github.com/jakehildreth/Locksmith/blob/main//Docs/Examples/Mode0.md\u003e\n\n\u003ca name=\"mode-1-identify-issues-and-fixes-output-to-console\" id=\"mode-1-identify-issues-and-fixes-output-to-console\"\u003e\u003c/a\u003e\n### Mode 1: Identify Issues and Fixes, Output to Console\n\nThis mode scans the current forest and outputs all discovered AD CS issues and possible fixes to the console in **List** format.\n\n``` powershell\n# Module Syntax\nInvoke-Locksmith -Mode 1\n```\n\n``` powershell\n# Script Syntax\n.\\Invoke-Locksmith.ps1 -Mode 1\n```\n\nExample Output for Mode 1: \u003chttps://github.com/jakehildreth/Locksmith/blob/main/Docs/Examples/Mode1.md\u003e\n\n\u003ca name=\"mode-2-identify-issues-output-to-csv\" id=\"mode-2-identify-issues-output-to-csv\"\u003e\u003c/a\u003e\n### Mode 2: Identify Issues, Output to CSV\n\nLocksmith Mode 2 scans the current forest and outputs all discovered AD CS issues to ADCSIssues.CSV in the present working directory.\n\n``` powershell\n# Module Syntax\nInvoke-Locksmith -Mode 2\n```\n\n``` powershell\n# Script Syntax\n.\\Invoke-Locksmith.ps1 -Mode 2\n```\n\nExample Output for Mode 2: \u003chttps://github.com/jakehildreth/Locksmith/blob/main/Docs/Examples/Mode2.md\u003e\n\n\u003ca name=\"mode-3-identify-issues-and-fixes-output-to-csv\" id=\"mode-3-identify-issues-and-fixes-output-to-csv\"\u003e\u003c/a\u003e\n### Mode 3: Identify Issues and Fixes, Output to CSV\n\nIn Mode 3, Locksmith scans the current forest and outputs all discovered AD CS issues and example fixes to ADCSRemediation.CSV in the present working directory.\n\n``` powershell\n# Module Syntax\nInvoke-Locksmith -Mode 3\n```\n\n``` powershell\n# Script Syntax\n.\\Invoke-Locksmith.ps1 -Mode 3\n```\n\nExample Output for Mode 3: \u003chttps://github.com/jakehildreth/Locksmith/blob/main/Docs/Examples/Mode3.md\u003e\n\n\u003ca name=\"mode-4-fix-all-issues\" id=\"mode-4-fix-all-issues\"\u003e\u003c/a\u003e\n### Mode 4: Fix All Issues\n\nMode 4 is the \"easy button.\" Running Locksmith in Mode 4 will identify all misconfigurations and offer to fix each issue. If there is any possible operational impact, Locksmith will warn you.\n\n``` powershell\n# Module Syntax\nInvoke-Locksmith -Mode 4\n```\n\n``` powershell\n# Script Syntax\n.\\Invoke-Locksmith.ps1 -Mode 4\n```\n\nExample Output for Mode 4: \u003chttps://github.com/jakehildreth/Locksmith/blob/main/Docs/Examples/Mode4.md\u003e\n\n\u003ca name=\"Scans\" id=\"Scans\"\u003e\u003c/a\u003e\n### Scans\n\nUse the `-Scans` parameter to choose which vulnerabilities to scan for. Acceptable values include `All`, `Auditing`, `ESC1`, `ESC2`, `ESC3`, `ESC4`, `ESC5`, `ESC6`, `ESC7`, `ESC8`, `ESC9`, `ESC11`, `ESC13`, `ESC15`, `EKEUwu`, `ESC16` or `PromptMe`. The `PromptMe` option presents an interactive list allowing you to select one or more scans.\n\n``` powershell\n# Run all scans\nInvoke-Locksmith -Scan All\n```\n\n``` powershell\n# Prompt the user for a list of scans to select\nInvoke-Locksmith.ps1 -Scans PromptMe\n```\n\n``` powershell\n# Scan for ESC1 vulnerable paths\nInvoke-Locksmith.ps1 -Scans ESC1\n```\n\n``` powershell\n# Scan for ESC1, ESC2, and ESC8 vulnerable paths\nInvoke-Locksmith.ps1 -Scans ESC1,ESC2,ESC8\n```\n\nThank you for using Locksmith! 💜\n","funding_links":[],"categories":["PowerShell"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjakehildreth%2FLocksmith","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjakehildreth%2FLocksmith","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjakehildreth%2FLocksmith/lists"}