# Import the Active Directory module
    Import-Module ActiveDirectory

    # Define the target computer account (with trailing $)
    $computerAccount = "COMPUTERNAME$"

    # Specify the certificate thumbprint (replace with your
    certificate's thumbprint)
    $thumbprint =
    "ABCDEF0123456789ABCDEF0123456789ABCDEF01"

    # Retrieve the certificate from the LocalMachine\My store
    $cert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-
   Object { $_.Thumbprint -eq $thumbprint }
    if (-not $cert) {
        Write-Error "Certificate with thumbprint $thumbprint not
    found."
        return
}

# --- Helper Function to Reverse the Serial Number ---
# This function splits the serial number into byte pairs and then reverses their order.
function Reverse-SerialNumber {
    param (
        [Parameter(Mandatory)]
        [string]$Serial
    )
    # Remove any spaces (if present) and split into pairs (assuming even number of hex digits)
    $serialClean = $Serial -replace '\s', ''
    $pairs = ([regex]::Matches($serialClean, '..')).Value
    # Reverse the array of pairs and join them back together
    [array]::Reverse($pairs)
    return [string]::Join('', $pairs)
}

# --- Extract Certificate Properties ---

# Mapping 1: Using Issuer and Subject
$mapping1 = "X509:<I>$($cert.Issuer)<S>$($cert.Subject)"

# Mapping 2: Using the Serial Number (reversed)
$reversedSerial = Reverse-SerialNumber -Serial $cert.SerialNumber
$mapping2 = "X509:<SN>$reversedSerial"

# Mapping 3: Using Subject Key Identifier (SKI)
# Retrieve the SKI extension (OID 2.5.29.14)
$skiExtension = $cert.Extensions | Where-Object { $_.Oid.Value -eq "2.5.29.14" }
if ($skiExtension) {
    # Format(true) returns the raw hex string (often with spaces); remove spaces for mapping
    $rawSki = $skiExtension.Format($true) -replace '\s',''
    $mapping3 = "X509:<SKI>$rawSki"
} else {
    Write-Warning "Subject Key Identifier not found on the certificate."
    $mapping3 = $null
}

# Combine the mappings into an array. Omit any that are $null.
$mappings = @($mapping1, $mapping2)
if ($mapping3) { $mappings += $mapping3 }

# Output the mapping strings for verification
Write-Output "Mapping Strings to be written to $computerAccount:"
$mappings | ForEach-Object { Write-Output $_ }

# --- Write the mappings to the computer account in Active Directory ---
# Use -Replace to overwrite existing altSecurityIdentities; use -Add if you prefer to append.
Set-ADComputer -Identity $computerAccount -Replace @{ altSecurityIdentities = $mappings }

Write-Output "Successfully updated altSecurityIdentities for computer account $computerAccount."