Skip to content
Pwnversity

GPO Abuse

Group Policy Objects (GPOs) are how AD applies configuration to users and computers: security policies, startup scripts, software installation, scheduled tasks, local group membership. A GPO is linked to OUs, sites, or the domain, and every object in that scope executes it. That power is the problem: if an attacker can modify a GPO (or create and link one), they execute code or grant privileges en masse on every affected computer —potentially the whole domain.

Threat model

Section titled “Threat model”

GPOs are, in effect, remote code execution at scale, governed by ACLs. The risk is twofold: write permissions over an existing GPO (applied by many computers), and permission to link GPOs to an OU (create a malicious one and link it where juicy objects live). Since GPOs refresh on their own (~90 min) and apply with SYSTEM/user privileges, the effect is immediate and wide.

Red Team

Section titled “Red Team”

Discovery

Section titled “Discovery”
# who can edit/link GPOs (PowerView / BloodHound)
Get-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs | ? {$_.ActiveDirectoryRights -match 'Write|Create'}
Get-DomainGPOLocalGroup          # GPOs granting local group membership
Get-DomainGPOUserLocalGroupMapping -Identity user   # where am I local admin via GPO

BloodHound flags GenericWrite/GenericAll/WriteDacl over GPO and GpLink over OUs → direct abuse routes.

Exploitation

Section titled “Exploitation”

With write over a GPO, inject an action that will run on every computer/user in scope:

# SharpGPOAbuse (Windows): add an immediate task running as SYSTEM
SharpGPOAbuse.exe --AddComputerTask --TaskName "upd" --Author DOMAIN\admin \
  --Command "cmd.exe" --Arguments "/c net user attacker P@ss /add & net localgroup administrators attacker /add" \
  --GPOName "GPO-Vulnerable"
# pyGPOAbuse (Linux): equivalent from outside Windows
pygpoabuse.py domain/user:pass -gpo-id <GUID> -command "..."

Typical injectable actions:

  • Immediate scheduled task (as SYSTEM on computers, or as the user) → code execution / shell.
  • Add a user to local Administrators on every computer in scope (Restricted Groups).
  • Malicious startup/logon script; MSI installation.
  • Modify user rights (e.g. grant yourself SeDebug) or security policies.

If the GPO affects many computers (or the domain itself / the DCs’ OU), this is mass escalation or directly to Domain Admin.

Linking a new GPO

Section titled “Linking a new GPO”

If you have GpLink permission over an OU (even without rights over existing GPOs), create a GPO, put the malicious action in it, and link it to that OU → the OU’s objects apply it.

Tools

Section titled “Tools”
  • SharpGPOAbuse (Windows) — inject tasks, local groups, scripts into a GPO.
  • pyGPOAbuse (Linux) — remote equivalent.
  • PowerView — GPO ACL enumeration and local-admin-by-GPO mapping.
  • BloodHound — abuse edges (WriteGPO, GpLink) and which computers fall.
  • Group3r / PingCastle — GPO auditing (also defensive).

Impact

Section titled “Impact”

Code execution as SYSTEM and/or granting of local admin on all computers in the GPO’s scope, simultaneously. Over a broad-scope GPO or the DCs’ OU, it’s full domain compromise.

Blue Team

Section titled “Blue Team”

Detection

Section titled “Detection”
  • GPO changes (modification of gPCFileSysPath, files in SYSVOL\...\Policies\): audit SYSVOL writes and GPO-change events.
  • Appearance of new scheduled tasks / Restricted Groups applied via GPO on many computers at once.
  • New GPO links (gPLink) over OUs, especially the DCs’ one.
  • Mass local-user creation / additions to Administrators.

Telemetry

Section titled “Telemetry”

Audit GPO-object changes (5136) and SYSVOL files; Sysmon on endpoints for GPO-applied tasks/scripts; alert on changes to the Default Domain / Domain Controllers GPOs.

Hardening

Section titled “Hardening”
  • Minimize who can edit and link GPOs: audit and trim the ACLs (WriteGPO/GpLink) with BloodHound/Group3r.
  • Especially protect the Default Domain Policy, the Default Domain Controllers Policy, and GPOs linked to the DCs’ OU (Tier 0).
  • Monitor SYSVOL for changes; review legacy GPOs with GPP (cpassword — MS14-025).
  • Tiering: Tier 0 GPO management only from PAWs by Tier 0 accounts.

Response

Section titled “Response”

Revert the modified GPO and its link, remove tasks/local users created on affected computers, rotate exposed credentials, and if DCs/domain were touched, treat the domain as compromised.

CVEs and real-world cases

Section titled “CVEs and real-world cases”
  • GPO abuse is a configuration TTP (MITRE T1484.001 Group Policy Modification), not a CVE.
  • MS14-025 (GPP cpassword) — passwords encrypted with a publicly known key in GPP, readable by any domain user; a classic finding still around.
  • SharpGPOAbuse/pyGPOAbuse appear in red-team reports and ransomware intrusions that use GPO to deploy the payload to the whole network at once.

Testing checklist

Section titled “Testing checklist”
  • Write over any existing GPO? (BloodHound WriteGPO)
  • GpLink permission over any OU (including the DCs’)?
  • Inject an immediate task (SharpGPOAbuse/pyGPOAbuse) → execution
  • Add yourself to local Administrators via GPO (Restricted Groups)
  • Does the GPO affect many computers / the DCs?
  • Legacy GPP with cpassword (MS14-025)
  • Blue: GPO- and SYSVOL-change auditing enabled?

References

Section titled “References”