Powershell Errors on 2026.1.4.1426

[danengh]

Describe the Bug

Powershell errors when running any mode (tried mode 0, mode 2). Specifically seeing errors on ESC6, ESC7 and ESC16

Steps To Reproduce

Invoke-Locksmith

Expected Behavior

No Errors

Environment

• Locksmith Version: 2026.1.4.1426
• OS: Windows Server 2022
• PowerShell Version: 5.1.20348.4294
• PowerShell Host: PowerShell

Additional Context

I am running this as a domain admin on a domain joined computer (not a domain controller or the CA server).

Identifying Certificate Authorities with EDITF_ATTRIBUTESUBJECTALTNAME2 enabled (ESC6)...
You cannot call a method on a null-valued expression.
At C:\Users\user\Documents\WindowsPowerShell\Modules\Locksmith\2026.1.4.1426\Private\Set-RiskRating.ps1:128
char:9

•     $SID = $Issue.IdentityReferenceSID.ToString()
  

•     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (:) [], RuntimeException
  • FullyQualifiedErrorId : InvokeMethodOnNull

Identifying Certificate Authorities with Non-Standard Admins (ESC7)...
Exception calling "Translate" with "1" argument(s): "Some or all identity references could not be translated."
At C:\Users\user\Documents\WindowsPowerShell\Modules\Locksmith\2026.1.4.1426\Private\Convert-IdentityReferenceToS
id.ps1:33 char:9

•     $SID = ($Principal.Translate([System.Security.Principal.Secur ...
  

•     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [], MethodInvocationException
  • FullyQualifiedErrorId : IdentityNotMappedException

You cannot call a method on a null-valued expression.
At C:\Users\user\Documents\WindowsPowerShell\Modules\Locksmith\2026.1.4.1426\Private\Set-RiskRating.ps1:69
char:13

•         $SID = $Issue.IdentityReferenceSID.ToString()
  

•         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (:) [], RuntimeException
  • FullyQualifiedErrorId : InvokeMethodOnNull

Get-ADObject : Variable: 'SID' found in expression: $SID is not defined.
At C:\Users\user\Documents\WindowsPowerShell\Modules\Locksmith\2026.1.4.1426\Private\Set-RiskRating.ps1:70
char:45

• ... enceObjectClass = Get-ADObject -Filter { objectSid -eq $SID } | Selec ...

•                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidArgument: (:) [Get-ADObject], ArgumentException
  • FullyQualifiedErrorId : ActiveDirectoryCmdlet:System.ArgumentException,Microsoft.ActiveDirectory.Management.Comm
    ands.GetADObject

Exception calling "Translate" with "1" argument(s): "Some or all identity references could not be translated."
At C:\Users\user\Documents\WindowsPowerShell\Modules\Locksmith\2026.1.4.1426\Private\Convert-IdentityReferenceToS
id.ps1:33 char:9

•     $SID = ($Principal.Translate([System.Security.Principal.Secur ...
  

•     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [], MethodInvocationException
  • FullyQualifiedErrorId : IdentityNotMappedException

You cannot call a method on a null-valued expression.
At C:\Users\user\Documents\WindowsPowerShell\Modules\Locksmith\2026.1.4.1426\Private\Set-RiskRating.ps1:69
char:13

•         $SID = $Issue.IdentityReferenceSID.ToString()
  

•         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (:) [], RuntimeException
  • FullyQualifiedErrorId : InvokeMethodOnNull

Get-ADObject : Variable: 'SID' found in expression: $SID is not defined.
At C:\Users\user\Documents\WindowsPowerShell\Modules\Locksmith\2026.1.4.1426\Private\Set-RiskRating.ps1:70
char:45

• ... enceObjectClass = Get-ADObject -Filter { objectSid -eq $SID } | Selec ...

•                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidArgument: (:) [Get-ADObject], ArgumentException
  • FullyQualifiedErrorId : ActiveDirectoryCmdlet:System.ArgumentException,Microsoft.ActiveDirectory.Management.Comm
    ands.GetADObject

Identifying Certificate Authorities with szOID_NTDS_CA_SECURITY_EXT disabled (ESC16)...
You cannot call a method on a null-valued expression.
At C:\Users\user\Documents\WindowsPowerShell\Modules\Locksmith\2026.1.4.1426\Private\Set-RiskRating.ps1:128
char:9

•     $SID = $Issue.IdentityReferenceSID.ToString()
  

•     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (:) [], RuntimeException
  • FullyQualifiedErrorId : InvokeMethodOnNull

[jakehildreth]

Thanks, @danengh

Do you get similar errors in Locksmith 2? The ESC7 parsing logic in LS1 is archaic comparatively.

[danengh]

I was able to run locksmith2 eventually. Installing the module directly resulted in a lot of errors but using git clone and then running the module locally worked great!

Not sure if you want to close out the issue or not since I didn't notice any errors running LS2.

[jakehildreth]

I definitely broke something in the latest PowerShell Gallery release! (As confirmed with another user earlier today...) Thanks for testing! I'll work on fixing the Gallery version soon.

[jakehildreth]

Gallery version should be updated now!

[danengh]

Just to clarify, was Locksmith or Locksmith2 gallery version updated?

[jakehildreth]

Locksmith2 Gallery Version. Sorry for being unclear!

[jakehildreth]

I will see if I can backport the ESC7 logic into Locksmith 1 now and get that updated too.

[danengh]

I just tried to install the Locksmith2 module using Install-Module -Name Locksmith2 -Scope CurrentUser today and still show all the same errors as before

WARNING: AceDefinitions.psd1 not found at
C:\Users\iamengh\Documents\WindowsPowerShell\Modules\Locksmith2\2026.4.140027..\Data\AceDefinitions.psd1. Unable to test for dangerous
permissions.

Directory: C:\Users\iamengh\Documents\WindowsPowerShell\Modules\Locksmith2\2026.4.140027

Mode LastWriteTime Length Name

---

-a---- 4/14/2026 12:27 AM 19187 Locksmith2.Classes.ps1
-a---- 4/14/2026 12:27 AM 1797 Locksmith2.psd1
-a---- 4/14/2026 12:27 AM 519985 Locksmith2.psm1

[jakehildreth]

Big sad.

[jakehildreth]

WARNING: AceDefinitions.psd1 not found at
C:\Users\iamengh\Documents\WindowsPowerShell\Modules\Locksmith2\2026.4.140027\..\Data\AceDefinitions.psd1. Unable to test for dangerous
permissions.

I see the error! Will fix when possible.