ADGPO-010: SYSVOL/AD GPO Version Mismatch
- Plataforma
- Active Directory
- Categoría
- AD Group Policy
- Severidad
- Medium
- Pilar de Zero Trust
- Governance (peso 0)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
For each GPO returned by Get-GPO -All, the check pulls two values per domain controller. From AD it reads the versionNumber attribute on CN={GUID},CN=Policies,CN=System,DC=domain,DC=tld via an LDAP query bound to each DC in turn (Get-ADObject -Server $dc). From SYSVOL it reads \\$dc\SYSVOL\$domain\Policies\{GUID}\gpt.ini and parses the Version= line under the [General] section. The versionNumber field is a 32-bit integer where the high 16 bits are the user version and the low 16 bits are the computer version, so the check splits it into UserVersion and ComputerVersion and compares against the gpt.ini value, which uses the same encoding. A GPO passes only when the AD versionNumber on every DC equals the SYSVOL gpt.ini Version on the same DC, and when both values are identical across every DC in the domain. The check also captures the GPC whenChanged timestamp, the gpt.ini file LastWriteTime, the gpt.ini Displayname field, and the GPO DisplayName, so a defender can correlate the mismatch with a specific edit window.
Por qué importa
A version mismatch breaks Group Policy in three ways, and each has security consequences. First, the Group Policy engine on a client uses the version number to decide whether to download the GPT contents from SYSVOL. If the GPC says version 12 but SYSVOL on the DC the client authenticated against still serves version 11, the client applies version 11 silently. Defensive settings shipped in the most recent edit, like a tightened AppLocker rule, a new Defender exclusion removal, a Restricted Groups change, or a firewall rule, simply do not land. The reverse is also dangerous: if SYSVOL on a DC carries a higher version than the GPC, the client trusts the higher number and applies whatever is in that GPT folder, which on a DC that replicated late or had a manual file copy may not be what the GPMC console shows. Second, version mismatches are the canonical fingerprint of DFSR replication backlog or a SYSVOL journal wrap. When DFSR stops replicating SYSVOL, GPO edits made on one DC never propagate. The administrator who made the change sees success in GPMC, but clients authenticating against other DCs apply the old policy. This is the failure mode behind multiple public outages where security baselines silently rolled back across half a fleet. Third, mismatches are a tradecraft indicator. An attacker who edits gpt.ini or the GPT contents directly on SYSVOL (rather than through the GPMC API) can change the policy without incrementing versionNumber in AD, causing some clients to refresh and others to skip the refresh, fragmenting the blast radius and making detection harder. Conversely, an attacker can increment the AD versionNumber without changing SYSVOL to force clients to re-download a tampered GPT cached on a single compromised DC. Both techniques map to T1484.001 (Group Policy Modification).
Ruta de ataque
1. Initial access: the attacker has compromised an account with write rights on a GPO (delegated edit rights, membership in Group Policy Creator Owners, or a compromised Tier-0 identity) or has SYSTEM on at least one domain controller. 2. Direct SYSVOL write: instead of using Set-GPRegistryValue or the GPMC UI (which updates both AD and SYSVOL atomically and increments versionNumber), the attacker writes directly to \\dc1\SYSVOL\domain\Policies\{GUID}\Machine\Scripts\Startup or to GptTmpl.inf under Microsoft\Windows NT\SecEdit. The file change replicates through DFSR but the GPC versionNumber stays at its previous value. 3. Selective version manipulation: the attacker either (a) leaves versionNumber unchanged so clients that have already cached this version skip the GPT re-download and apply the malicious payload from their local cache silently on the next refresh, or (b) manually increments versionNumber in AD and writes a matching value into gpt.ini on the DC they control, but does not let the change replicate to peer DCs, fragmenting which clients receive the payload based on which DC they authenticate against. 4. Detection evasion: because GPMC pulls the report from a single DC, the operator viewing the GPO sees consistent settings. The mismatch is only visible if a defender enumerates versionNumber and gpt.ini across every DC and compares. Standard Event ID 5136 (directory object modified) fires only on AD changes, not on SYSVOL-only changes. Event ID 4663 on the SYSVOL share fires only when file auditing is explicitly enabled on the Policies subtree, which most environments skip. 5. Persistence: the modified GPT contents continue to execute on every refresh until a defender either runs Get-GPOReport against the SYSVOL contents (not the GPC cache) or notices the version drift. DFSR backlog alarms on monitoring tools often suppress this finding as a known replication health issue rather than escalating it as a security event.
Cómo lo evalúa Guerrilla
Guerrilla enumerates domain controllers with Get-ADDomainController -Filter * and iterates every GPO from Get-GPO -All. For each (GPO, DC) tuple the check executes two operations. First, it queries AD: Get-ADObject -Identity "CN={$gpoId},CN=Policies,CN=System,$domainDN" -Server $dc -Properties versionNumber,whenChanged. Second, it reads SYSVOL: Get-Content "\\$dc\SYSVOL\$domain\Policies\{$gpoId}\gpt.ini" and parses the [General] section with a regex to extract Version=. Both integers are split into user (high 16 bits) and computer (low 16 bits) components using ($v -shr 16) and ($v -band 0xFFFF). The check then performs three comparisons per GPO: AD-vs-SYSVOL on each individual DC, AD-vs-AD across the DC set, and SYSVOL-vs-SYSVOL across the DC set. Any inequality is recorded with the GPO DisplayName, GPO GUID, the offending DC names, the observed AD versionNumber, the observed SYSVOL Version, the AD whenChanged timestamp, the gpt.ini LastWriteTime, and a classification string (ADGreaterThanSysvol, SysvolGreaterThanAD, InterDCDrift, MissingGptIni, MissingGpcObject). Output rows are deduplicated by GPO so a single GPO with drift across five DCs produces one row with all five DC names listed.
Valor recomendado
All GPO versions match between AD GPC objects and SYSVOL GPT gpt.ini files across all domain controllers
Remediación
Compare the versionNumber attribute in AD with the Version value in SYSVOL gpt.ini for each GPO across all domain controllers. Investigate and resolve any DFSR or FRS replication issues causing mismatches. Force replication using repadmin /syncall and DFSRDIAG. For persistent mismatches, use the authoritative restore process for SYSVOL.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-3, CM-6, SI-7
- MITRE ATT&CK
- T1484.001