ADGPO-011: GPO Settings Security Analysis
- Plataforma
- Active Directory
- Categoría
- AD Group Policy
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 2)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
For each GPO returned by Get-GPO -All, the check calls Get-GPOReport -ReportType Xml and inspects the following nodes inside Computer/ExtensionData and User/ExtensionData: - Account policies: minimum password length, password complexity (PasswordComplexity), password history, max password age, min password age, reversible encryption (ClearTextPassword), and account lockout threshold / duration / observation window. - Kerberos policy: max user / service ticket lifetime, max ticket renewal, max tolerance for clock sync, enforce user logon restrictions. - User rights assignments under SecuritySettings/UserRightsAssignment: who holds SeDebugPrivilege, SeTcbPrivilege, SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeTakeOwnershipPrivilege, SeLoadDriverPrivilege, SeEnableDelegationPrivilege, SeRemoteInteractiveLogonRight, SeNetworkLogonRight, and the deny rights (SeDenyNetworkLogonRight, SeDenyInteractiveLogonRight). - Restricted Groups (SecuritySettings/RestrictedGroups): membership of Administrators, Backup Operators, Server Operators, Account Operators, Print Operators, Remote Desktop Users, and any other group with elevated rights. - Security Options (SecuritySettings/SecurityOptions): the standard MS Security Guide registry policies, including NoLMHash, LmCompatibilityLevel, RestrictAnonymous, RestrictAnonymousSAM, RequireSignOrSeal, RequireStrongKey, EnableLUA, ConsentPromptBehaviorAdmin, FilterAdministratorToken, RestrictRemoteSAM, RestrictReceivingNTLMTraffic, RestrictSendingNTLMTraffic, AuditReceivingNTLMTraffic, SMB signing (RequireSecuritySignature on LanmanServer and LanmanWorkstation), and LSA protection (RunAsPPL). - Windows Firewall with Advanced Security (WindowsFirewall extension): per-profile state (Domain / Private / Public), inbound / outbound default action, allow rules that open SMB, RDP, WinRM, RPC, or LLMNR / NetBIOS ports broadly, and disabled firewall profiles. - Audit policy (AuditPolicy and Advanced Audit Policy under AuditSettings): subcategory coverage for Logon, Account Logon, Object Access, Privilege Use, Detailed Tracking, Policy Change, Account Management, DS Access; flags audit settings of "No Auditing" or "Success only" on subcategories that require Success + Failure (Credential Validation, Kerberos Authentication Service, Sensitive Privilege Use, Process Creation). - Defender configuration (Registry / Preferences pointing at HKLM\Software\Policies\Microsoft\Windows Defender): DisableAntiSpyware, DisableRealtimeMonitoring, DisableBehaviorMonitoring, DisableScriptScanning, exclusions for paths / processes / extensions. - Legacy and dangerous registry values: AllowInsecureGuestAuth on SMB, RestrictDriverInstallationToAdministrators, EnableMulticast (LLMNR), NodeType (NetBIOS), DisableRestrictedAdmin (RDP CredSSP), AutoAdminLogon, DontDisplayLastUserName. Every deviation from the Microsoft Security Baseline / CIS Active Directory Benchmark default is emitted as a finding with the GPO DisplayName, GUID, setting path, observed value, baseline value, and linked SOM list so the blast radius is explicit.
Por qué importa
Group Policy is a force multiplier. A single weakened setting in a GPO linked to the Domain Root downgrades the security posture of every member computer in the forest at the next refresh cycle. The misconfigurations this check finds map directly to documented attack chains: - LmCompatibilityLevel set below 5 allows NTLMv1 negotiation, which an attacker on the wire can capture and relay or crack offline (T1187, T1557.001). Setting it to 0 or 1 on a domain controller also enables LM hash storage downstream of NoLMHash. - NoLMHash = 0 stores LM hashes in SAM and NTDS.dit, trivially cracked. - RequireSecuritySignature on SMB disabled enables SMB relay (T1557.001, MS08-068 era and modern coerced-auth relay to LDAP and ADCS). - RunAsPPL = 0 disables LSASS protection and permits Mimikatz sekurlsa::logonpasswords against the LSASS process (T1003.001). - SeDebugPrivilege granted to non-admins enables process-token theft and LSASS dumping. SeImpersonatePrivilege granted broadly enables Potato-family local privilege escalation (T1134.001). - SeBackupPrivilege or SeRestorePrivilege granted to non-admins allows reading any file on the host including NTDS.dit and SYSTEM hive on a DC, then offline DCSync via secretsdump (T1003.003). - SeEnableDelegationPrivilege on non-admins allows configuring constrained or unconstrained delegation on arbitrary accounts (T1558.003). - Restricted Groups adding a non-Tier-0 principal to local Administrators on every workstation is the classic privilege-escalation persistence (T1078.002, T1098). - EnableLUA = 0 disables UAC entirely. ConsentPromptBehaviorAdmin = 0 silently elevates all admin prompts. - Firewall set to Off on the Domain or Private profile exposes SMB, RPC, and WinRM on the local network and removes the last barrier between an initial-access foothold and lateral movement (T1562.004). - Defender DisableRealtimeMonitoring = 1 or broad path exclusions (C:\, C:\Users\, C:\Windows\Temp) blind EDR and AV (T1562.001). - Audit policy with Failure auditing disabled on Credential Validation, Kerberos, and Logon blinds the SIEM to password spray, Kerberoasting, and AS-REP roasting attempts (T1562.002). - Group Policy Preferences items containing the cpassword attribute leak a static-AES-key encrypted credential readable by every authenticated user from SYSVOL (CVE-2014-1812). Every one of these settings is enforced through GPOs. ADGPO-011 surfaces the source GPO so remediation is one edit instead of a fleet-wide registry push.
Ruta de ataque
1. Discovery: the attacker, with any authenticated user, enumerates GPOs via Get-GPO -All, PowerView Get-DomainGPO, or SharpHound (-CollectionMethod GPOLocalGroup). They pull each GPO report with Get-GPOReport -ReportType Xml or read the SYSVOL files directly. SYSVOL is readable by Authenticated Users by design, so no privileged access is required for reconnaissance (T1615, T1087.002). 2. Posture mapping: the attacker greps the XML and the SYSVOL files for security-relevant settings. High-value findings include GPOs that lower LmCompatibilityLevel, disable SMB signing, grant SeDebugPrivilege or SeImpersonatePrivilege to non-admin groups, add a group to local Administrators via Restricted Groups, disable Defender or set broad exclusions, or contain GPP cpassword. 3. Credential harvest from GPP: if any GPO contains a cpassword attribute in groups.xml, scheduledtasks.xml, services.xml, datasources.xml, printers.xml, or drives.xml under SYSVOL\Policies\{GUID}\Machine\Preferences\, the attacker decrypts it with the public Microsoft AES key (Get-GPPPassword, gpp-decrypt). This yields a working credential, often a local administrator account reused across the estate (CVE-2014-1812). 4. Privilege abuse via weakened user rights: where a GPO grants SeDebugPrivilege, SeBackupPrivilege, or SeImpersonatePrivilege to a broader group than Administrators, the attacker pivots through any account in that group. SeBackupPrivilege on a DC plus a logon, even non-interactive, allows offline NTDS.dit extraction with reg save and DSInternals Get-ADDBAccount. 5. Defense impairment: where Defender is disabled or has broad exclusions, the attacker drops tooling into the excluded path. Where RunAsPPL is disabled, sekurlsa::logonpasswords succeeds against LSASS. Where SMB signing is not required, NTLM relay through tools such as ntlmrelayx, with coercion via PetitPotam / PrinterBug / DFSCoerce, becomes practical against LDAP and ADCS web enrollment (CVE-2021-36942). 6. Persistence via Restricted Groups: if the attacker can edit a GPO (delegated edit rights, member of Group Policy Creator Owners, WriteDACL on the GPO object), they add their own SID to a Restricted Groups Administrators entry in a GPO linked broadly. Every machine in scope honors the entry at the next refresh and the attacker has local admin everywhere (T1098, T1078.002, T1484.001). 7. Audit blinding: the attacker edits or links a GPO that sets advanced audit subcategories to No Auditing, ensuring future actions are not logged. This is often paired with disabling the Windows Event Log service via Service Control GPO settings.
Cómo lo evalúa Guerrilla
Guerrilla loads the GroupPolicy and ActiveDirectory modules, calls Get-GPO -All -Domain $env:USERDNSDOMAIN, and for each GPO calls Get-GPOReport -Guid $gpo.Id -ReportType Xml. The XML is cast to [xml] and walked with XPath. The check evaluates each security-relevant node against a baseline table embedded in the module: - /GPO/Computer/ExtensionData/Extension/Account[@Name] for password and lockout policy. - /GPO/Computer/ExtensionData/Extension/UserRightsAssignment for SeDebug / SeImpersonate / SeBackup / SeRestore / SeTakeOwnership / SeLoadDriver / SeEnableDelegation and the deny rights. - /GPO/Computer/ExtensionData/Extension/RestrictedGroups/GroupName and Member entries. - /GPO/Computer/ExtensionData/Extension/SecurityOptions/Display for security options and the matching SettingNumber or SettingString. - /GPO/Computer/ExtensionData/Extension/AuditSetting (advanced audit policy) and AuditPolicy (legacy). - /GPO/Computer/ExtensionData/Extension/Windows Firewall InboundFirewallRules and FirewallProfiles per profile. - /GPO/Computer/ExtensionData/Extension/RegistrySettings and Preferences/Registry items for Defender, UAC, LSA, and SMB registry values. - SYSVOL files under \\domain\SYSVOL\domain\Policies\{GUID}\Machine\Preferences\Groups\groups.xml (and the other GPP XML files) are read directly and grepped for the cpassword attribute to detect MS14-025 / CVE-2014-1812 residue, including in historical .bak files. Each deviation is emitted as a record with: GpoName, GpoId, SettingCategory (PasswordPolicy / UserRights / RestrictedGroups / SecurityOptions / Firewall / Audit / Defender / GPP), SettingName, ObservedValue, BaselineValue, Severity, LinkedScopes, and a Notes field explaining the security impact. Findings linked to the Domain Controllers OU, the Domain Root, or a Tier-0 OU are escalated automatically.
Valor recomendado
All GPO settings align with organizational security baseline; no GPOs that weaken default security configurations
Remediación
Export all GPO reports and analyze security-relevant settings including password policies, account lockout, user rights assignments, restricted groups, security options, and Windows Firewall rules. Compare settings against CIS benchmarks or organizational baselines. Remediate GPOs that configure weaker-than-baseline settings.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| informational | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-6, CM-6(1), AC-3
- MITRE ATT&CK
- T1484.001, T1484