GPO
GPO (Group Policy Object) = virtual collection of policy settings with a unique name.
Used to manage configuration in Active Directory.
Linked to OUs (Organizational Units); affects objects in that OU and child OUs.
By default, GPOs apply to Authenticated Users.
Can be filtered by AD groups or WMI filters (e.g., only Windows 10 machines).
Only Domain Admins (or similar roles) can modify GPOs by default.
Delegation can allow lower-privileged users to edit GPOs.
If a GPO can be edited by normal users, attackers can:
Add startup scripts
Add scheduled tasks
Compromise many computers in affected OUs
GPOs used for software installs or scripts may use files from network shares.
If network share or file permissions (NTFS) are weak, attackers can:
Replace legitimate files with malicious ones
Gain system-level access even if GPO is secure
Attack
Simple GPO edit or file replacement
Prevention
Lock down GPO permissions, only specific account can edit it
Dont deploy shared files that many users can modify
Detection
Fortunately, it is straightforward to detect when a GPO is modified. If Directory Service Changes auditing is enabled, then the event ID 5136 will be generated
From a defensive point of view, if a user who is not expected to have the right to modify a GPO suddenly appears here, then a red flag should be raised.
Honeypot
Some orgs leave misconfigured GPOs on purpose to detect attacks.
Works only if the org is mature and can respond immediately.
Otherwise, it can become a weak spot if abused before detection.
Honeypot Setup
Link honeypot GPO to non-critical servers only.
Monitor continuously for changes (e.g., every 15 minutes).
If GPO is modified:
Disable the user(s) who made the change.
Unlink GPO from all OUs to stop the attack path.
Use PowerShell to automate detection + response.
Powershell Script
Looks for event ID 5136 (GPO modified) in the last 15 minutes.
Checks if the modification was on the honeypot GPO (by GUID).
For each modifying user:
If user is enabled → disable account immediately.
Optional: Send email alert (Send-MailMessage).
Displays output with disabled usernames (e.g.,
Disabled user bob).Disabling the user generates event ID 4725 (account disabled).
How the script looks:
Last updated