ADGPO-011: Análisis de seguridad de las configuraciones de GPO
- Plataforma
- Active Directory
- Categoría
- AD Group Policy
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 2)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Las configuraciones de las GPO pueden debilitar la postura de seguridad si deshabilitan protecciones, relajan los requisitos de autenticación o configuran valores predeterminados inseguros. Esta comprobación analiza las configuraciones clave relevantes para la seguridad en todas las GPO, incluidas las políticas de contraseñas, el bloqueo de cuentas, las asignaciones de derechos de usuario, las opciones de seguridad y las políticas de auditoría
Por qué importa
Group Policy is a force multiplier. A single weakened setting in a GPO linked to the Domain Root downgrades the security posture of every member computer in the forest at the next refresh cycle. The misconfigurations this check finds map directly to documented attack chains: - LmCompatibilityLevel set below 5 allows NTLMv1 negotiation, which an attacker on the wire can capture and relay or crack offline (T1187, T1557.001). Setting it to 0 or 1 on a domain controller also enables LM hash storage downstream of NoLMHash. - NoLMHash = 0 stores LM hashes in SAM and NTDS.dit, trivially cracked. - RequireSecuritySignature on SMB disabled enables SMB relay (T1557.001, MS08-068 era and modern coerced-auth relay to LDAP and ADCS). - RunAsPPL = 0 disables LSASS protection and permits Mimikatz sekurlsa::logonpasswords against the LSASS process (T1003.001). - SeDebugPrivilege granted to non-admins enables process-token theft and LSASS dumping. SeImpersonatePrivilege granted broadly enables Potato-family local privilege escalation (T1134.001). - SeBackupPrivilege or SeRestorePrivilege granted to non-admins allows reading any file on the host including NTDS.dit and SYSTEM hive on a DC, then offline DCSync via secretsdump (T1003.003). - SeEnableDelegationPrivilege on non-admins allows configuring constrained or unconstrained delegation on arbitrary accounts (T1558.003). - Restricted Groups adding a non-Tier-0 principal to local Administrators on every workstation is the classic privilege-escalation persistence (T1078.002, T1098). - EnableLUA = 0 disables UAC entirely. ConsentPromptBehaviorAdmin = 0 silently elevates all admin prompts. - Firewall set to Off on the Domain or Private profile exposes SMB, RPC, and WinRM on the local network and removes the last barrier between an initial-access foothold and lateral movement (T1562.004). - Defender DisableRealtimeMonitoring = 1 or broad path exclusions (C:\, C:\Users\, C:\Windows\Temp) blind EDR and AV (T1562.001). - Audit policy with Failure auditing disabled on Credential Validation, Kerberos, and Logon blinds the SIEM to password spray, Kerberoasting, and AS-REP roasting attempts (T1562.002). - Group Policy Preferences items containing the cpassword attribute leak a static-AES-key encrypted credential readable by every authenticated user from SYSVOL (CVE-2014-1812). Every one of these settings is enforced through GPOs. ADGPO-011 surfaces the source GPO so remediation is one edit instead of a fleet-wide registry push.
Ruta de ataque
1. Discovery: the attacker, with any authenticated user, enumerates GPOs via Get-GPO -All, PowerView Get-DomainGPO, or SharpHound (-CollectionMethod GPOLocalGroup). They pull each GPO report with Get-GPOReport -ReportType Xml or read the SYSVOL files directly. SYSVOL is readable by Authenticated Users by design, so no privileged access is required for reconnaissance (T1615, T1087.002). 2. Posture mapping: the attacker greps the XML and the SYSVOL files for security-relevant settings. High-value findings include GPOs that lower LmCompatibilityLevel, disable SMB signing, grant SeDebugPrivilege or SeImpersonatePrivilege to non-admin groups, add a group to local Administrators via Restricted Groups, disable Defender or set broad exclusions, or contain GPP cpassword. 3. Credential harvest from GPP: if any GPO contains a cpassword attribute in groups.xml, scheduledtasks.xml, services.xml, datasources.xml, printers.xml, or drives.xml under SYSVOL\Policies\{GUID}\Machine\Preferences\, the attacker decrypts it with the public Microsoft AES key (Get-GPPPassword, gpp-decrypt). This yields a working credential, often a local administrator account reused across the estate (CVE-2014-1812). 4. Privilege abuse via weakened user rights: where a GPO grants SeDebugPrivilege, SeBackupPrivilege, or SeImpersonatePrivilege to a broader group than Administrators, the attacker pivots through any account in that group. SeBackupPrivilege on a DC plus a logon, even non-interactive, allows offline NTDS.dit extraction with reg save and DSInternals Get-ADDBAccount. 5. Defense impairment: where Defender is disabled or has broad exclusions, the attacker drops tooling into the excluded path. Where RunAsPPL is disabled, sekurlsa::logonpasswords succeeds against LSASS. Where SMB signing is not required, NTLM relay through tools such as ntlmrelayx, with coercion via PetitPotam / PrinterBug / DFSCoerce, becomes practical against LDAP and ADCS web enrollment (CVE-2021-36942). 6. Persistence via Restricted Groups: if the attacker can edit a GPO (delegated edit rights, member of Group Policy Creator Owners, WriteDACL on the GPO object), they add their own SID to a Restricted Groups Administrators entry in a GPO linked broadly. Every machine in scope honors the entry at the next refresh and the attacker has local admin everywhere (T1098, T1078.002, T1484.001). 7. Audit blinding: the attacker edits or links a GPO that sets advanced audit subcategories to No Auditing, ensuring future actions are not logged. This is often paired with disabling the Windows Event Log service via Service Control GPO settings.
Cómo lo evalúa Guerrilla
Guerrilla loads the GroupPolicy and ActiveDirectory modules, calls Get-GPO -All -Domain $env:USERDNSDOMAIN, and for each GPO calls Get-GPOReport -Guid $gpo.Id -ReportType Xml. The XML is cast to [xml] and walked with XPath. The check evaluates each security-relevant node against a baseline table embedded in the module: - /GPO/Computer/ExtensionData/Extension/Account[@Name] for password and lockout policy. - /GPO/Computer/ExtensionData/Extension/UserRightsAssignment for SeDebug / SeImpersonate / SeBackup / SeRestore / SeTakeOwnership / SeLoadDriver / SeEnableDelegation and the deny rights. - /GPO/Computer/ExtensionData/Extension/RestrictedGroups/GroupName and Member entries. - /GPO/Computer/ExtensionData/Extension/SecurityOptions/Display for security options and the matching SettingNumber or SettingString. - /GPO/Computer/ExtensionData/Extension/AuditSetting (advanced audit policy) and AuditPolicy (legacy). - /GPO/Computer/ExtensionData/Extension/Windows Firewall InboundFirewallRules and FirewallProfiles per profile. - /GPO/Computer/ExtensionData/Extension/RegistrySettings and Preferences/Registry items for Defender, UAC, LSA, and SMB registry values. - SYSVOL files under \\domain\SYSVOL\domain\Policies\{GUID}\Machine\Preferences\Groups\groups.xml (and the other GPP XML files) are read directly and grepped for the cpassword attribute to detect MS14-025 / CVE-2014-1812 residue, including in historical .bak files. Each deviation is emitted as a record with: GpoName, GpoId, SettingCategory (PasswordPolicy / UserRights / RestrictedGroups / SecurityOptions / Firewall / Audit / Defender / GPP), SettingName, ObservedValue, BaselineValue, Severity, LinkedScopes, and a Notes field explaining the security impact. Findings linked to the Domain Controllers OU, the Domain Root, or a Tier-0 OU are escalated automatically.
Valor recomendado
Todas las configuraciones de las GPO se alinean con la línea base de seguridad de la organización; ninguna GPO que debilite las configuraciones de seguridad predeterminadas
Remediación
Exporte todos los informes de GPO y analice las configuraciones relevantes para la seguridad, incluidas las políticas de contraseñas, el bloqueo de cuentas, las asignaciones de derechos de usuario, los grupos restringidos, las opciones de seguridad y las reglas del Firewall de Windows. Compare las configuraciones con los benchmarks de CIS o las líneas base de la organización. Corrija las GPO que configuren valores más débiles que la línea base.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| informational | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-6, CM-6(1), AC-3
- MITRE ATT&CK
- T1484.001, T1484