ADACL-013: GPO Link Permissions
- Platform
- Active Directory
- Category
- AD ACL & Delegation
- Severity
- High
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
For every organizational unit, the domain naming context root, and every container under CN=Sites,CN=Configuration, the check reads the nTSecurityDescriptor and enumerates ACEs that grant write access to the gPLink attribute (schemaIDGUID f30e3bbe-9ff0-11d1-b603-0000f80367c1) or the gPOptions attribute (schemaIDGUID f30e3bbf-9ff0-11d1-b603-0000f80367c1). Rights that count include WriteProperty on the specific attribute, WriteProperty on the gPLink/gPOptions property set, GenericWrite, GenericAll, and WriteDacl/WriteOwner (which permit ACL self-grant). Principals are resolved and any identity that is not a domain administrator equivalent (Domain Admins, Enterprise Admins, SYSTEM, BUILTIN\Administrators, or an explicitly tiered Group Policy administrator group) is reported. Inherited ACEs are evaluated separately from explicit ACEs because inherited grants on the domain root propagate to every child OU.
Why it matters
Group Policy is a code execution channel that runs as SYSTEM on every joined machine in scope. A user who can write gPLink on an OU can link a GPO they control, or whose security filtering they can change, and that GPO will then execute startup scripts, scheduled tasks, Immediate Tasks, MSI installs, registry edits, and security setting changes on every computer in the OU on the next Group Policy refresh cycle (90 minutes by default, immediate at boot or logon). When the affected container is the Domain Controllers OU or the domain root, the blast radius includes domain controllers, which means tier zero compromise. When the affected container is a site object under CN=Sites, the link applies cross-domain to every computer in that site. This is the same primitive that BloodHound surfaces as the GPLink edge and that ATT&CK tracks as T1484.001.
Attack path
1. Attacker (or compromised low-privilege user) is identified by BloodHound as having a GenericWrite, WriteProperty, or WriteDacl edge against a target OU, the domain root, or a site object. 2. Attacker creates a new GPO in a container they can write to, or selects an existing GPO whose contents or security filtering they can modify. 3. Attacker writes a malicious payload into the GPO: a Scheduled Task with Immediate Task action under Computer Configuration > Preferences > Control Panel Settings > Scheduled Tasks, a startup script under Computer Configuration > Policies > Windows Settings > Scripts, or a Restricted Group entry that adds an attacker-controlled account to local Administrators. SharpGPOAbuse and pyGPOAbuse automate this step. 4. Attacker appends a gPLink reference to the target container using Set-ADObject, PowerView Set-DomainObject, or LDAP modify, pointing to the malicious GPO with the enforced flag (gPOptions bit 2) so user-level Block Inheritance cannot stop it. 5. Within one Group Policy refresh interval, every computer in scope executes the payload as NT AUTHORITY\SYSTEM. If the linked container was the Domain Controllers OU, the attacker now controls every DC.
How Guerrilla assesses it
Guerrilla queries the directory using System.DirectoryServices for every objectClass in (organizationalUnit, domainDNS, site, container) under the partitions naming context. For each object, the nTSecurityDescriptor is read with SACL omitted, and the DACL is walked. For each ACE the check resolves the ObjectType GUID against the schema and tests for write rights on gPLink (f30e3bbe-9ff0-11d1-b603-0000f80367c1) or gPOptions (f30e3bbf-9ff0-11d1-b603-0000f80367c1), as well as the broader GenericWrite (0x00020028), GenericAll (0x000F01FF), WriteDacl (0x00040000), and WriteOwner (0x00080000) bits. The SID in each ACE is resolved through the local domain and forest trust path; any SID that does not map to an expected high-privilege group is emitted as a finding with the container DN, the granting ACE, the rights mask, and whether the ACE is inherited.
Recommended value
GPO link permissions restricted to authorized Group Policy administrators only
Remediation
Audit gPLink and gPOptions write permissions on all OUs, the domain root, and site objects. Remove GPO link permissions from non-administrative principals. Use Group Policy Modeling to verify the impact of current GPO links. Implement change control for GPO linking operations.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6, CM-5
- ANSSI
- vuln_gpo_link_permissions
- MITRE ATT&CK
- T1484.001