ADGPO-007: Inconsistencias de permisos de GPO
- Plataforma
- Active Directory
- Categoría
- AD Group Policy
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Cada GPO tiene tanto permisos de AD (sobre el objeto GPC) como permisos NTFS (sobre la carpeta GPT de SYSVOL). Las inconsistencias entre estos conjuntos de permisos pueden impedir la aplicación de la GPO, permitir modificaciones no autorizadas o crear brechas de seguridad donde el contenido de SYSVOL sea más permisivo que el objeto de AD
Por qué importa
The AD GPC and the SYSVOL GPT are two halves of one trust boundary, and the client-side Group Policy engine enforces the weaker of the two. If SYSVOL is more permissive than AD, an attacker with file-system write access to a GPT folder can drop a malicious GptTmpl.inf (Restricted Groups, User Rights Assignment, Privilege Rights), a poisoned Registry.pol, an Immediate Scheduled Task XML under ScheduledTasks\ScheduledTasks.xml, or a startup script under Machine\Scripts\Startup, and the next gpupdate on every targeted machine will execute it as SYSTEM. The AD-side audit trail shows nothing: no GPC modification, no Event ID 5136, no gPLink change. Defenders who only watch directory service auditing see a quiet GPO and miss code execution on every domain-joined host the GPO applies to. The inverse failure (AD more permissive than SYSVOL) breaks GPO application: clients read the GPC, follow the gPCFileSysPath pointer to SYSVOL, get access denied on Registry.pol, and the entire GPO silently fails with Event ID 1058 in the operational log. Critical security baselines (Default Domain Controllers Policy, LAPS, AppLocker, attack surface reduction rules) stop applying and the estate drifts out of compliance without anyone noticing. The check also catches the canonical SYSVOL hardening regression where MS16-072 / KB3163622 enforcement requires Authenticated Users to retain Read on the GPC but operators sometimes strip it expecting the old user-context evaluation, breaking computer-scope application across the entire domain.
Ruta de ataque
1. Discovery: the attacker enumerates GPOs with Get-GPO -All or PowerView Get-DomainGPO and pulls both ACLs. Get-DomainObjectAcl -SearchBase "CN=Policies,CN=System,DC=corp,DC=contoso,DC=com" returns the AD side. Get-Acl on \\corp.contoso.com\SYSVOL\corp.contoso.com\Policies\{GUID} returns the NTFS side. BloodHound edges GenericAll, GenericWrite, WriteDacl, WriteOwner on GPO nodes surface the AD-side rights. SharpHound -CollectionMethod GPOLocalGroup walks GPT contents. 2. Target selection: the attacker filters for GPOs where SYSVOL grants a non-privileged principal Write or Modify but the GPC does not. Common drift sources are help-desk groups historically granted Modify on SYSVOL for script management, decommissioned service accounts left in the DACL, project teams given SYSVOL access during a migration and never removed, and GPOs created by tools that set NTFS but not AD permissions correctly. 3. Weaponization: the attacker writes directly to the GPT folder. To force a Restricted Groups membership add, edit Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf and add a [Group Membership] section with *S-1-5-32-544__Members = attacker SID. To run code as SYSTEM on every targeted machine, drop ScheduledTasks\ScheduledTasks.xml with an Immediate Scheduled Task (T1053.005). To establish persistence on logon, drop User\Scripts\Logon\beacon.ps1 and register it in scripts.ini. To bump the version so clients re-apply, increment the Version value in gpt.ini and the versionNumber attribute on the GPC (the latter requires AD write, which the attacker does not have, so they instead wait for the next 90-minute refresh which still re-reads the GPT). 4. Replication: DFSR (or FRS on legacy estates) replicates the new GPT contents to every DC. No GPC modification event fires because nothing in AD changed. The only telemetry is SYSVOL file-system auditing, which is rarely enabled. 5. Execution: at the next Group Policy refresh, every machine in the linked OU pulls the GPT, applies the malicious Restricted Groups / Scheduled Task / startup script, and executes the payload as SYSTEM. For a GPO linked at the Domain Controllers OU, this is code execution on every DC. 6. Cleanup: the attacker reverts the GPT files to their pre-attack state, replicates again, and leaves no AD trail. To a defender skimming GPMC, the GPO never changed.
Cómo lo evalúa Guerrilla
Guerrilla loads the GroupPolicy and ActiveDirectory modules, enumerates GPOs with Get-GPO -All, and for each GPO reads two security descriptors. The AD side uses Get-Acl "AD:\CN={$gpoId},CN=Policies,CN=System,$($domainDN)" to materialise an ActiveDirectorySecurity object; the access rules are normalised to (IdentityReference, ActiveDirectoryRights, AccessControlType, ObjectType, InheritedObjectType) tuples. The NTFS side uses Get-Acl "\\$($env:USERDNSDOMAIN)\SYSVOL\$($env:USERDNSDOMAIN)\Policies\{$($gpoId)}" to materialise a FileSystemSecurity object; rules are normalised to (IdentityReference, FileSystemRights, AccessControlType, InheritanceFlags). The check then performs three comparisons. (a) Required-principal presence: Authenticated Users, SYSTEM, Domain Admins, Enterprise Admins, and Creator Owner must appear with the expected minimum rights on both sides; missing entries are flagged. (b) Drift detection: every non-built-in principal present on one side is searched on the other, and an asymmetry is flagged when a principal has Write/Modify/Full Control on SYSVOL with no equivalent Write/GenericWrite on the GPC, or vice versa. (c) Hardening violations: any GPT ACE granting Everyone, Anonymous Logon, or Authenticated Users beyond ReadAndExecute is flagged as critical. The check also shells out to dcdiag /test:sysvolcheck /test:netlogons and parses the pass/fail status per DC, surfacing replication-level inconsistencies that an ACL diff alone would miss. Output rows include DisplayName, Id, OwnerAd, OwnerSysvol, OwnersMatch (bool), AuthUsersReadAd (bool), AuthUsersReadSysvol (bool), DriftedPrincipals (array of @{Identity, AdRights, SysvolRights, MoreOpenSide}), HardeningViolations (array), DcdiagStatus, and Severity.
Valor recomendado
Permisos consistentes entre los objetos GPC de AD y las carpetas GPT de SYSVOL para todas las GPO; Authenticated Users con acceso de lectura
Remediación
Compare el descriptor de seguridad de cada objeto GPC en AD con la ACL NTFS de la carpeta GPT correspondiente en SYSVOL. Asegúrese de que ambos concedan acceso de lectura a Authenticated Users (necesario para la aplicación de la GPO). Resuelva cualquier inconsistencia alineando los permisos de SYSVOL con el objeto de AD. Ejecute dcdiag /test:sysvolcheck para identificar problemas.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-3, CM-6
- MITRE ATT&CK
- T1484.001, T1222.001