_       _____  _______ _     _ _______ _______ _____ _______ _     _
 |      |     | |       |____/  |______ |  |  |   |      |    |_____|
 |_____ |_____| |_____  |    \_ ______| |  |  | __|__    |    |     |
     .--.                  .--.                  .--.
    /.-. '----------.     /.-. '----------.     /.-. '----------.
    \'-' .---'-''-'-'     \'-' .--'--''-'-'     \'-' .--'--'-''-'
     '--'                  '--'                  '--'

A small tool built to find and fix common misconfigurations in Active Directory Certificate Services.

1. Installation
2. Run Locksmith
   1. Mode 0
   2. Mode 1
   3. Mode 2
   4. Mode 3
   5. Mode 4
   6. Scans
3. Security and Support

1. Locksmith must be run on a domain joined system.
2. The ActiveDirectory and ServerManager PowerShell modules must be installed before importing the Locksmith module.
3. Administrative rights may be required for some checks and for remediation.

Open a PowerShell prompt and install Locksmith from the PowerShell Gallery:

Install-Module -Name Locksmith -Scope CurrentUser

1. Download and Use the Module Without Installing It

   1. Download the latest module version.
   2. Open a PowerShell prompt to the location of the extracted file and run:

   Unblock-File .\Locksmith.zip # if necessary to unblock the download
   Expand-Archive .\Locksmith.zip
   Import-Module .\Locksmith\Locksmith.psd1
   Invoke-Locksmith

2. Download the Standalone Script Without Module

   1. Download the latest monolithic (all-in-one) script version.
   2. Open a PowerShell prompt to the location of the downloaded file and run:

   Unblock-File .\Invoke-Locksmith.zip
   Expand-Archive .\Invoke-Locksmith.zip -DestinationPath .\
   .\Invoke-Locksmith.ps1

There are several modes you can choose from when running Invoke-Locksmith. You can also use the Scans parameter to choose which scans you want to invoke.

Running Invoke-Locksmith.ps1