ADACL-014: GPO Edit Permissions
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check enumerates each groupPolicyContainer object under CN=Policies,CN=System,DC=<domain> and reads the nTSecurityDescriptor attribute. For every access control entry (ACE) it inspects the ActiveDirectoryRights, the ObjectType GUID, and the trustee SID. Any ACE granting GenericAll, GenericWrite, WriteDacl, WriteOwner, or the Edit-settings extended right (CN=Edit-Settings, GUID edacfd8f-ffb3-11d1-b41d-00a0c968f939) to a principal outside Domain Admins, Enterprise Admins, SYSTEM, or Group Policy Creator Owners produces a finding. Guerrilla also walks the matching \\<domain>\SYSVOL\<domain>\Policies\{GUID} folder and compares NTFS DACLs against the AD object DACL, because divergence between the two halves of a GPO is itself an indicator of stale or malicious delegation. The gPCFileSysPath, displayName, and whenChanged values are recorded for triage.
Por qué importa
A GPO is a code execution primitive. An identity that can write to a GPO that applies to Domain Controllers, Tier 0 servers, or workstations used by privileged users can deploy an Immediate Scheduled Task, a startup script, a Restricted Group membership change, or an MSI installer that runs as SYSTEM on every linked machine at the next gpupdate cycle. This is the canonical T1484.001 "Domain Policy Modification: Group Policy Modification" path and is one of the highest-value lateral movement and privilege escalation techniques in Active Directory. Help desk groups, server admins, application owners, and legacy delegations frequently accumulate Edit rights on GPOs that link to sensitive OUs, creating shadow paths to Domain Admin that bypass formal tier separation. BloodHound surfaces these as the GenericAll, GenericWrite, WriteDacl, and WriteOwner edges on GPO nodes and treats them as direct attack paths.
Ruta de ataque
Step 1: Reconnaissance. The attacker, holding a low-privilege foothold, runs BloodHound or SharpHound and looks for GenericAll, GenericWrite, WriteDacl, WriteOwner, or AllExtendedRights edges from a controlled principal to any GPO node. The "Shortest Paths to Domain Admins from Owned Principals" query and the per-GPO node tab make this trivial. Step 2: Target selection. The attacker chooses a GPO that links to a high-value scope: the Domain Controllers OU, a Tier 0 server OU, or an OU containing privileged user workstations. Step 3: Weaponization. Using SharpGPOAbuse (FSecureLabs), pyGPOAbuse (Synacktiv), or native PowerShell with the GroupPolicy module, the attacker injects an Immediate Scheduled Task into the GPO. The task runs as NT AUTHORITY\SYSTEM and executes an arbitrary command, a Cobalt Strike beacon, or adds a controlled account to the local Administrators group via Restricted Groups. Step 4: Trigger. The attacker waits for the next Group Policy refresh (90 minutes plus a 0-30 minute random offset, or immediately on reboot), or forces it via Invoke-GPUpdate against reachable targets. Step 5: Execution. Every machine in scope runs the payload as SYSTEM, yielding broad code execution. If the GPO links to the Domain Controllers OU, this is direct DA. The attacker then removes the Immediate Task and the SYSVOL artifacts to limit forensic evidence.
Cómo lo evalúa Guerrilla
Guerrilla binds to the domain over LDAP, enumerates groupPolicyContainer objects (objectClass=groupPolicyContainer) under CN=Policies,CN=System, and pulls nTSecurityDescriptor for each. The descriptor is parsed into individual ACEs. For every ACE the check evaluates ActiveDirectoryRights against the mask {GenericAll, GenericWrite, WriteDacl, WriteOwner, WriteProperty} and the ObjectType against the Edit-Settings extended right GUID. Trustee SIDs are translated and tested for membership outside the default privileged set (S-1-5-32-544, Domain Admins, Enterprise Admins, SYSTEM, Group Policy Creator Owners). Findings are paired with gPCFileSysPath, the link locations from gpLink on the relevant OU, and the SYSVOL NTFS ACL read via Get-Acl. The check does not require Domain Admin privileges to execute, only authenticated read access to the Policies container, which any domain user has by default.
Valor recomendado
GPO edit permissions restricted to Group Policy Creator Owners and authorized administrators only
Remediación
Review the security filtering and delegation tabs on each GPO. Verify that only authorized principals have Edit settings, Delete, or Modify security permissions. Remove GPO edit permissions from non-administrative groups. Use the Group Policy Management Console to audit GPO permissions systematically.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, CM-5, CM-6
- ANSSI
- vuln_gpo_edit_permissions
- MITRE ATT&CK
- T1484.001