ADGPO-016: Registry Settings Security Review
- Plataforma
- Active Directory
- Categoría
- AD Group Policy
- Severidad
- Medium
- Pilar de Zero Trust
- Governance (peso 1)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
For each domain in the forest, the check enumerates groupPolicyContainer objects under CN=Policies,CN=System and walks the gPCFileSysPath UNC (\\<domain>\SYSVOL\<domain>\Policies\{GUID}\). On both the \Machine and \User sides it parses two artifact types. First, registry.pol (the binary file produced by the Administrative Templates CSE) is decoded using the documented PReg format (signature 0x67655250 "PReg", version 0x00000001, followed by [key;value;type;size;data] records). Second, every Preferences\Registry\Registry.xml is parsed for <Registry> elements (Group Policy Preferences Registry items). The resulting (hive, key path, value name, type, data) tuples are matched against a security-relevant rule set that includes: HKLM\SYSTEM\CurrentControlSet\Control\Lsa values (RunAsPPL, LmCompatibilityLevel, NoLMHash, RestrictAnonymous, DisableRestrictedAdmin, TokenLeakDetectDelaySecs, DisableDomainCreds, EveryoneIncludesAnonymous), HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential, HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters and LanmanWorkstation\Parameters signing values (RequireSecuritySignature, EnableSecuritySignature, SMB1), HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System UAC values (EnableLUA, ConsentPromptBehaviorAdmin, FilterAdministratorToken, LocalAccountTokenFilterPolicy), HKLM\SOFTWARE\Policies\Microsoft\Windows Defender (DisableAntiSpyware, DisableRealtimeMonitoring, Exclusions\Paths, Exclusions\Processes), HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell (EnableScriptBlockLogging, EnableModuleLogging, EnableTranscripting), HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Winlogon (AutoAdminLogon, DefaultPassword, DefaultUserName), HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server (fDenyTSConnections, UserAuthentication), and HKLM\SOFTWARE\Policies\Microsoft\Cryptography (ForceMachineKeyset, weak cipher suites). Each match produces a finding with the GPO display name, GUID, the OUs it is linked to (gPLink on each container), the literal value being written, and the severity-weighted reason it is flagged.
Por qué importa
A registry value pushed by a GPO is not a local setting. It is a forest-wide change-management primitive that runs as SYSTEM on every machine in scope at the next group policy refresh (90 to 120 minutes by default, immediately on gpupdate /force). A single line in registry.pol that sets HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential to 1 re-enables WDigest plaintext credential caching on every workstation that receives the policy, handing the attacker cleartext passwords from LSASS at the next interactive logon. Setting HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL to 0 disables LSA protection and re-enables Mimikatz-class credential theft against lsass.exe. Setting EnableLUA to 0 disables User Account Control consent prompts for the local administrator token, allowing silent privilege elevation. Adding C:\ or C:\Windows\Temp to Windows Defender Exclusions\Paths neutralizes endpoint AV across the fleet. Setting LocalAccountTokenFilterPolicy to 1 enables remote pass-the-hash with local administrator accounts. Pushing a malicious Subsystems\Optional or Lsa\Notification Packages value loads an attacker-controlled DLL into LSASS at every boot, achieving forest-wide persistence (MITRE T1547.008 / T1547.005 Authentication Package). The blast radius is the OU tree the GPO is linked to: a single registry value in the Default Domain Policy applies to every domain-joined machine in the forest. Because the change is a small binary diff in registry.pol on SYSVOL, it is invisible to most file-integrity tooling and to administrators who never open GPMC to look at the Preferences or Administrative Templates branches of an unfamiliar GPO. ADGPO-016 is rated Medium because exploitation typically requires existing GPO edit rights, but the practical impact of a single weaponized value is forest-wide credential theft, EDR neutralization, or boot-persistent code execution.
Ruta de ataque
Step 1: GPO write primitive. The attacker obtains Edit settings, delete, modify security on at least one widely linked GPO. Common paths: BloodHound surfaces GenericWrite, GenericAll, WriteDacl, or WriteOwner edges on a groupPolicyContainer, an over-delegated help desk group, an OU-level Delegation of Control wizard grant of "Manage Group Policy links" combined with GPO edit rights, or membership in Group Policy Creator Owners on a GPO they originally created. Step 2: Target selection. The attacker enumerates Get-GPO -All, sorts by the number of linked OUs (Get-GPOReport returns LinksTo), and picks a high-link-count GPO that is unlikely to be reviewed (a generic naming convention like "Workstation Baseline" or "Standard User Settings"). A GPO linked to the Domain Controllers OU is preferred for forest takeover; a GPO linked to the domain root reaches every joined machine. Step 3: Payload selection. The attacker picks one or more registry values that map to a concrete objective. For credential theft: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential = 1 (re-enable WDigest), HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL = 0 (disable LSA protection). For EDR evasion: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableRealtimeMonitoring = 1 or Exclusions\Paths\C:\ = 0. For lateral movement: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = 1 (enable remote local-admin auth). For persistence: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages = <attacker DLL name> (loaded by LSASS at boot, T1547.005). Step 4: Deployment. The attacker uses the GroupPolicy module (Set-GPRegistryValue -Name "Workstation Baseline" -Key "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" -ValueName UseLogonCredential -Type DWord -Value 1) or writes directly to SYSVOL\<domain>\Policies\{GUID}\Machine\Registry.pol with a tool like SharpGPOAbuse, pyGPOAbuse, or a custom PReg writer. Group Policy Preferences Registry XML (Preferences\Registry\Registry.xml) is an alternate channel that adds an item-level targeting filter to limit scope (for example, only apply to machines where an EDR sensor is installed) and reduces the chance of breakage on unintended targets. Step 5: Replication and activation. SYSVOL replicates via DFS-R within minutes. Clients apply the registry change on the next group policy background refresh (90 to 120 minutes, randomized) or immediately on gpupdate /force. Many of the targeted values take effect on the next user logon (WDigest, LSA Notification Packages) or on the next service restart, which the attacker can force via Restart-Service or scheduled reboots. Step 6: Cleanup. The attacker can either leave the malicious value in place (most environments never review registry.pol contents) or revert it after harvesting credentials, leaving only a brief versionNumber increment and an event 5136 directory service change on the PDC emulator as forensic evidence.
Cómo lo evalúa Guerrilla
Guerrilla binds to each domain in the forest and enumerates (objectClass=groupPolicyContainer) under CN=Policies,CN=System. For each GPO it resolves gPCFileSysPath, walks \Machine and \User on SYSVOL, and parses every Registry.pol using the PReg binary format documented in MS-GPREG. Each record yields (hive, subkey, value name, REG_ type, data length, data bytes). The check then enumerates Preferences\Registry\Registry.xml under both sides and parses every <Registry> element for (Hive, Key, Name, Type, Value, status, removePolicy, action). Both result sets feed a pattern matcher: case-insensitive key-path prefix match against a curated rule set (LSA, WDigest, SMB signing, UAC, Defender, PowerShell logging, Winlogon AutoLogon, Terminal Server, Cryptography), and value-aware comparison (for example, UseLogonCredential = 1 is a violation, UseLogonCredential = 0 is compliant; RunAsPPL = 0 is a violation, RunAsPPL = 1 or 2 is compliant; any path under Defender Exclusions\Paths is flagged for review with severity weighted by how broad the path is). For each finding, the check captures the GPO displayName, GUID, gPLink targets resolved up the OU tree, nTSecurityDescriptor on the GPO (to identify which principals could modify it), versionNumber and whenChanged on the AD object (to indicate recency), and the literal key/value/data so the operator can immediately reproduce the finding in GPMC or with Get-GPRegistryValue.
Valor recomendado
No GPO registry settings that weaken security defaults; all registry modifications documented and justified
Remediación
Export GPO registry settings from Administrative Templates and Registry Preferences. Review settings that affect security-relevant registry keys including HKLM\SYSTEM\CurrentControlSet\Control\Lsa, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies, and authentication-related keys. Remove or correct settings that weaken security posture.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-6, CM-6(1)
- MITRE ATT&CK
- T1484.001, T1112