A screenshot of Locksmith that says: Executing Mode 4 - Attempting to fix all identified issues! Creating a script (Invoke-RevertLocksmith.psl) which can be used to revert any changes made by Locksmith... ISSUE: Auditing is not fully enabled on Certification Authority "foal-CA". TECHNIQUE: DETECT ACTION TO BE PERFORMED: Locksmith will attempt to fully enable auditing on Certification Authority "foal-CA". COMMAND(S) TO BE RUN: PS> certutil.exe -config 'WIN-SUHK7VS9FN6.foal.horse.local\foal-CA' -setreg 'CA\AuditFilter' 127; Invoke-Command -Comput erName 'WIN-SUHK7VS9FN6.foal.horse.local' -ScriptBlock { Get-Service -Name 'certsvc' | Restart-Service -Force } OPERATIONAL IMPACT: This change should have little to no impact on the AD CS environment. If you continue, Locksmith will attempt to fix this issue. Continue with this operation? [Y] Yes [N] No:

Notices where this attachment appears

Jake Hildreth (acorn) :blacker_heart_outline: (horse@infosec.exchange)'s status on Saturday, 16-Dec-2023 21:35:23 JST

Jake Hildreth (acorn) :blacker_heart_outline:

Locksmith v2023.12 is now available!

This month, the Locksmith team discovered people are actually using Mode 4 (auto-remediation) in the wild. To be honest, we let Mode 4 languish because none of us would trust a fully automated remediation tool... even if we wrote it!

But since it's being used, we should definitely improve it. The new Mode 4 is much more explicit about what the issue is, why it's an issue, and how it will be remediated. Lastly, the Operational Impact is spelled out in plain language and color coded so it's more obvious when a fix may negatively impact operations. (see attached image)

After Locksmith is done fixing stuff on your behalf, you'll get an indicator that it's done instead of just dropping back to the console.

We also resolved some output issues (fewer duplicates), false positives (bitwise math is weird), and cleaned up the scripts used to build the project.

Grab it here: https://github.com/TrimarcJake/Locksmith/releases/tag/v2023.12

PS> Install-Module Locksmith

Thank you for using ❤ Locksmith ❤

Public

Notices where this attachment appears