Group Policy (GPO) basics
You find the domain’s GPOs in LDAP, read how they are linked to OUs and the link options (enabled, disabled, enforced), download their files from SYSVOL and extract the password policy from the UTF-16 security template; at the end you find the GPO carrying an old-style password (GPP cpassword) and the GPO whose link was disabled, and report them. GPO names and values differ in every lab.
Level 201 · 50 min
Configuring hundreds of computers one by one is impossible in a company. Group Policy does it centrally: password rules, screen lock, USB bans, software installs, local admin accounts…
A GPO has two parts: its record in LDAP (name, version, where it lives) and its files in SYSVOL (the actual settings). When a GPO is linked (gPLink) to an OU, the domain or a site, it applies to the users and computers in that container. The figure shows this journey.
SYSVOL must be readable by every domain user, because every computer reads its policies from there. That is why every secret put into SYSVOL is everyone’s secret.
What you will do in this lesson
- Find the GPOs in LDAP
- The links: gPLink
- From GUID to name
- Look at SYSVOL
- Download the policies
- Read the security template: GptTmpl.inf
- A password in SYSVOL: GPP cpassword
- The policy that doesn’t apply
- Group Policy findings
- Short quiz
Skills you will earn
- Finding GPOs in LDAP and resolving a GUID to its name
- Reading GPO links and their options (gPLink ;0 ;1 ;2)
- Inspecting policy files in SYSVOL
- Reading the UTF-16 security template (GptTmpl.inf)
- Finding GPP cpassword in SYSVOL (MS14-025)
- Writing audit findings into a report
← Auditing SMB shares and their permissions · Active Directory security: auditing and hardening · Delegation risks →
Start for free