HackBlue

Tools · Active Directory defense · 23 / 25

A GPO display name is not the GUID

The display name of a Group Policy Object is a label. The GUID is the object. Two policies can share a label. Write the GUID when you say which policy you reviewed.

9 min read · practice only with authorization

The name can be reused

Get-GPO and the Group Policy console show a display name people can edit. Renaming a policy changes the label and does not change the GUID. Creating a second policy with the same label is allowed. The name alone does not pick one object.

If your note has only the display name, write “GUID not recorded.” Do not look up “the” policy with that name later and assume it is the same object.

The GUID is the object

The GUID is how the directory and SYSVOL identify that policy. A link on an OU points at a GUID. A folder under SYSVOL uses that GUID. Quote the GUID when you say which policy the link applies.

A display name in a screenshot is still a label. Open the object and copy the GUID if the screenshot cropped it.

What to write down

File the display name and the GUID together. If two objects share a name, file both GUIDs and do not merge their settings. A setting you read belongs to the GUID you opened.

Lab: two policies named Lab baseline

The lab domain has two GPOs both named Lab baseline. Their GUIDs end in -aa11 and -bb22. The OU Workstations links -aa11. A draft says “Lab baseline” disables a setting and does not say which object, after reading -bb22.

The note quotes both GUIDs and both names. The setting that was read is on -bb22. The OU link is -aa11. They are not one policy. The draft sentence is split into those two facts.

Snippet
display name on both: Lab baseline
GUID ...-aa11: linked on OU Workstations
GUID ...-bb22: the object that was opened
write: name plus GUID
not: one policy called Lab baseline

Diagram

What identifies a GPO

The label can collide. The GUID does not.

  • Display name

    A label. Another object can use the same words.

  • GUID

    The object. Links and SYSVOL folders use this.

  • A link on an OU

    Points at one GUID. Record that GUID.

  • Name only in the note

    Say the GUID was not recorded.

Check yourself

1. Two GPOs are both named Lab baseline and have different GUIDs. How many policies are they?

2. An OU links GUID -aa11 and you read settings on -bb22. What did you read?

3. The screenshot shows the display name and not the GUID. What do you write?