Group Policy security review: GPO permissions, SYSVOL passwords, and risky settings

Who can edit a GPO controls its targets

A GPO linked to the Domain Controllers OU runs on every DC. Anyone who can edit that GPO can add a startup script or scheduled task that runs as SYSTEM on DCs. Review edit permissions on every GPO linked to Tier 0 assets and on the Default Domain Policy.

Get-GPPermission shows who has GpoEdit, GpoEditDeleteModifySecurity, or custom rights. Only Tier 0 administrators should edit GPOs that apply to Tier 0.

Snippet

Get-GPO -All | ForEach-Object { $g=$_; Get-GPPermission -Guid $g.Id -All | Where-Object { $_.Permission -match 'Edit' -and $_.Trustee.Name -notmatch 'Domain Admins|Enterprise Admins|SYSTEM' } | Select @{n='GPO';e={$g.DisplayName}}, @{n='Trustee';e={$_.Trustee.Name}}, Permission }

Old passwords in SYSVOL

Group Policy Preferences once allowed setting local account passwords, mapped drive credentials, and service passwords in GPOs. They were stored in XML files in SYSVOL with a cpassword attribute encrypted with a key Microsoft published. Microsoft removed the ability to create them in 2014 with MS14-025, but existing files were not deleted.

Any authenticated user can read SYSVOL, so any remaining cpassword value is effectively a published password.

Snippet

findstr /S /I /M cpassword \\lab.internal\SYSVOL\lab.internal\Policies\*.xml
Get-ChildItem \\lab.internal\SYSVOL -Recurse -Include *.xml,*.ps1,*.bat,*.vbs,*.cmd -ErrorAction SilentlyContinue | Select-String -Pattern "cpassword|password\s*=" -List | Select Path

Lab: review one GPO end to end

Create a GPO linked to the Servers OU, add a startup script from SYSVOL, and grant the helpdesk group edit rights. Run the permission query and the SYSVOL search, then generate a report with Get-GPOReport to read every setting. Remove the helpdesk permission and confirm.

Also search scripts in SYSVOL for embedded credentials. Logon scripts that map drives with net use and a password are still common.

Snippet

Get-GPOReport -Name 'Servers Baseline' -ReportType Html -Path C:\gpo-servers.html
Set-GPPermission -Name 'Servers Baseline' -TargetName 'Helpdesk' -TargetType Group -PermissionLevel None

Settings worth checking

Restricted Groups and Group Policy Preferences local group settings that add broad groups to local Administrators. User rights assignments that grant SeDebugPrivilege or “Log on as a service” widely. Scheduled tasks and startup scripts that point to paths writable by ordinary users.

Changes to GPOs are logged as 5136 on DCs with Directory Service Changes auditing. Alert on changes to GPOs linked to Tier 0.

Diagram

GPO review steps

Permissions
Who can edit GPOs that reach sensitive OUs.
SYSVOL
Search for cpassword and embedded credentials.
Command
```
findstr /S /I /M cpassword \\domain\SYSVOL\*.xml
```
Settings
Read reports for local admin grants, rights, and scripts.
Monitor
Alert on 5136 changes to Tier 0 GPOs.

Check yourself

1. Why do edit rights on a GPO linked to Domain Controllers matter?

2. Why is a cpassword in SYSVOL a serious finding?

3. Which cmdlet exports every setting in a GPO?