Locksmith Tool for Active Directory Certificate Services

Locksmith is a PowerShell security tool that identifies and helps remediate misconfigurations in Active Directory Certificate Services (AD CS). It checks certificate templates, permissions, and certification authority settings that could expose an organization to privilege escalation or certificate abuse.

AD CS provides the infrastructure for issuing and managing digital certificates used for authentication, encryption, and secure communication. Microsoft’s AD CS documentation explains how certificate authorities and enrollment policies support these services.

How the Locksmith Tool Audits AD CS

Locksmith scans an Active Directory forest for configuration weaknesses and reports the issues it discovers. Depending on the selected mode, it can display findings, suggest fixes, export reports, or offer remediation actions.

Its checks help administrators review certificate enrollment permissions, certificate templates, certification authority configuration, and related registry settings. These areas matter because overly permissive templates or incorrectly configured certificate authorities can create paths to elevated access.

For a broader view of Active Directory security, explore Adalanche, an Active Directory ACL visualization tool, which helps researchers understand directory permissions and relationships.

Key Features of Locksmith

Misconfiguration detection: Identifies security weaknesses in AD CS configurations across the current forest.
Remediation guidance: Shows suggested fixes for detected issues in supported output modes.
Multiple reporting formats: Displays findings in the console or exports them to CSV files for review and documentation.
Targeted scanning: Uses the -Scans parameter to select specific checks, including ESC1, ESC2, ESC3, ESC4, and other supported categories.
PowerShell integration: Supports module-based use and a standalone script option.

Locksmith is most useful as part of a regular Active Directory security review. You can complement certificate configuration checks with GPOHunter for auditing Active Directory Group Policy security.

Requirements and Installation

Locksmith must run on a domain-joined system. The ActiveDirectory and ServerManager PowerShell modules must be available, and some checks or remediation actions may require administrative rights.

Install the module from the PowerShell Gallery using the following command:

Install-Module -Name Locksmith -Scope CurrentUser

After installation, run the default audit from a PowerShell session:

Invoke-Locksmith

The default mode scans the current Active Directory forest and displays detected issues in a console table. Review the output before making any changes to production certificate services.

Locksmith Scan and Reporting Modes

Locksmith provides several modes for reviewing findings and planning remediation.

Mode	Purpose
`0`	Displays detected issues in a console table.
`1`	Displays findings and suggested fixes in a console list.
`2`	Exports detected issues to `ADCSIssues.CSV`.
`3`	Exports detected issues and suggested fixes to `ADCSRemediation.CSV`.
`4`	Identifies misconfigurations and offers remediation actions, warning about possible operational impacts.

Run a specific reporting mode with these commands:

# Display findings and proposed fixes
Invoke-Locksmith -Mode 1

# Export detected issues
Invoke-Locksmith -Mode 2

# Export findings with remediation guidance
Invoke-Locksmith -Mode 3

CSV reports are useful for tracking findings, assigning remediation tasks, and comparing audit results over time. Store reports securely because they may reveal sensitive details about your organization’s certificate infrastructure.

Choose Specific AD CS Security Checks

The -Scans parameter lets you select checks instead of running every supported scan. The available options depend on the Locksmith version, and the project documentation lists categories such as ESC1 through ESC9, ESC11, ESC13, ESC15, and ESC16.

# Select specific scan categories
Invoke-Locksmith -Scans ESC1,ESC2,ESC8

# Use the interactive scan selector
Invoke-Locksmith -Scans PromptMe

Run targeted checks during focused investigations, then review the resulting findings against your certificate templates and certification authority configuration. Locksmith reports should support a documented review process rather than replace manual validation.

Review Remediation Before Applying Changes

Mode 4 offers to fix identified issues and warns when actions may affect the environment. Before approving a change, review the proposed commands, assess certificate enrollment dependencies, and confirm that you have a tested rollback plan.

For official installation instructions, supported scan categories, and current remediation behavior, consult the Locksmith GitHub repository and Microsoft’s guidance on how to secure, delegate, and audit certification authority administration.