Start your free Preview
ProductHow it worksSee what's realFix it safelyCatch attacksGraphneIntegrationsPlay the graphWeekly puzzlePricing
IndustriesHealthcareFinancial servicesGovernmentEducation
ResourcesDocsDetection catalogPosture check catalogChangelogBlog
CompanyTrustAboutCareersPressContact
Start your free Preview
Docs menu

Group Policy Security Checks: GPO Edit and Link Rights, cpassword and SYSVOL

Find who can edit or link Group Policy objects (GPOs), where Group Policy Preferences store passwords (cpassword) in SYSVOL, and where policy settings leave authentication weak, then fix them.

Roles
Operator or Admin to see findings and run a fix. Viewers don't see the Security Posture page.
Applies to
Active Directory
Updated
On this page

Overview

A Group Policy object (GPO) runs on every computer it applies to. Whoever can edit one, or link one where it reaches domain controllers, can run code on those computers. The policy files in SYSVOL, the shared folder on domain controllers that holds Group Policy files, can also store passwords and weak authentication settings.

The Group Policy category on the Security Posture page checks all three areas. Each failing check becomes a finding with evidence and a fix. The checks run after each sync, with nothing to turn on.

Ten checks run, in four groups. An eleventh, Lower-tier account can link Group Policy to a site, is listed but always reads Not assessed, because GraphnAI doesn't analyze site-linked policies yet.

Prerequisites

  • Role: Operator or Admin.
  • Data: At least one finished sync of an on-premises Active Directory domain. Entra ID has no Group Policy, so these checks read Doesn't apply there.
  • Attack path analysis turned on, for the two checks on who can edit a policy.
  • An up-to-date Identity Bridge that can read SYSVOL, for the checks that read policy files. See Why a check reads Not assessed.

The checks

Who can edit a policy

  • Lower-tier account can edit a Group Policy object that applies to Tier 0 computers (Critical). An account outside Tier 0 can change the policy, and the policy applies to domain controllers or other Tier 0 computers. Remove the account's edit rights, or remove it from the group that holds them.
  • Account can edit a Group Policy object that applies to more critical computers (High). The same risk at a lower level: the policy applies to computers more critical than the account.
  • Lower-tier account can link Group Policy above Tier 0 computers (High). These accounts can link policies to the domain, or to a container that holds domain controllers or other Tier 0 computers. A linked policy runs on every computer below it. Exchange setup grants some of these permissions.

Passwords in policy files

  • Group Policy preference stores a password (Critical). A Group Policy Preferences item in SYSVOL stores an account password in a cpassword attribute (MS14-025). Any authenticated domain user can read SYSVOL, and the key that decrypts these passwords is public. Treat the password as known. The check also covers leftover folders of policies that no longer exist.

Weak settings

  • Domain password policy stores passwords with reversible encryption (High). Passwords changed while the setting is on can be decrypted by anyone who reads the directory database.
  • Group Policy allows LAN Manager password hashes to be stored (Medium, High when the policy is linked above domain controllers). LAN Manager hashes are cracked in minutes.
  • Group Policy sends LAN Manager or NTLMv1 responses (High). These responses can be cracked or relayed.
  • Domain controllers accept LAN Manager or NTLMv1 authentication (High). No policy sets the domain controllers to refuse both.
  • Link-Local Multicast Name Resolution not turned off by Group Policy (Medium, High when the container holds Tier 0 computers). Anyone on the same network can answer the name lookups of the Windows computers in the container and capture their credentials. One finding covers each container of computers.
  • Group Policy grants administrator-equivalent rights to a lower-tier account (High, Critical when the policy applies to Tier 0 computers). The rights include debugging programs and backing up files. A broad group such as Everyone also counts.

The default Domain Policy and Domain Controllers Policy aren't flagged for their normal service grants.

Why a check reads Not assessed

A check that can't run reads Not assessed and names the reason. It never reads Passing. See How results read.

Checks Reason What to do
The two checks on who can edit a policy "the Group Policy control analysis hasn't completed for this connector. It runs with attack path analysis, which may be turned off" Turn on attack path analysis and wait for the next sync that collects changes.
The checks that read policy files "this domain's Group Policy files in SYSVOL haven't been read successfully in the last 7 days, or the connector's bridge needs an update to collect them" Update the bridge, and check that it can read SYSVOL.
The checks that read policy files, when the bridge has no SYSVOL access "this connector's bridge isn't set up to read SYSVOL, so these checks can't run. Configure SYSVOL access for the bridge" Configure SYSVOL access for the bridge.

The window in the second reason is your configured limit, written in words. The default is 7 days. The link-permission check needs neither SYSVOL nor attack path analysis.

The Bridges page notice

A bridge that predates Group Policy file reading shows Update this bridge for Group Policy checks on the Bridges page. Until you update it, the checks that read SYSVOL show as Not assessed, and the directory's posture coverage reads partial. There's no button: install the new bridge bundle. The notice goes away after the bridge's next successful sync.

After a GraphnAI upgrade, the checks fill in on their own. The edit checks fill in after the next attack path analysis. The file checks fill in after the updated bridge's first full SYSVOL read.

Reading a finding

Select Exposure > Security Posture, then select the Group Policy card. Select a row to open the finding's drawer. Which sections you see depends on the check.

Section What it shows
Who can edit this policy The accounts that can edit it, how many computers the policy applies to, and how many are Tier 0. Lower tier marks an account that raises the finding. A Disabled account can't log on, so it doesn't raise it. A line under each account says how it holds control, for example "fully controls".
Who can link policies here The accounts that can link policies to the container. Granted by Exchange marks permissions Exchange setup created. Inherited from names the container a grant comes from.
Tier 0 computers below it The Tier 0 computers a policy linked here would reach.
Where it's linked The containers the policy is linked to. Enforced marks an enforced link. Whole domain or Above Tier 0 computers marks a wide link. A filter on the policy means it may apply to fewer computers than shown.
Stored passwords found Each preference file that stores a password, how many, and the kind of preference.
Leftover policy folders Folders in SYSVOL for policies that no longer exist. Every authenticated user can still read them.
Setting The setting that raised the finding, as Windows names it, and the file it's in.
Rights granted The rights a policy grants, grouped by right. Any account marks a broad group. Entries that name an account instead of a security identifier can't be checked, and a line counts them.
Why it isn't covered For name resolution and domain controller authentication: the policies that would cover the container but have a filter, have computer settings turned off, or are overridden. A sample of the computers left open follows.

GraphnAI never collects stored passwords. It records where a password is stored and how many, never the password.

Fixing findings

For Lower-tier account can link Group Policy above Tier 0 computers, the drawer offers Select Fire. It removes the account's permission to link policies on the container.

  1. Open the finding and select Select Fire.
  2. Review the preview. Exchange setup grants some of these permissions, and removing one stops Exchange tasks that link policies. Confirm with your Exchange administrator first.
  3. Approve the change. This fix is manual: you approve each change one at a time, and no automation runs it.

A grant inherited from a higher container is removed at the container it comes from. The drawer names that container. See Select Fire and Remediation Reversibility and Undo.

Everything else

GraphnAI doesn't edit Group Policy settings or files. Fix the rest in Group Policy Management:

  • Edit rights: change the policy's delegation. To act now, open an account in the Graph Explorer. Select Fire can remove its group membership, or its permission to link policies.
  • Stored passwords: delete the preference item or the leftover folder, then change the account's password.
  • Settings: change the setting the drawer names, in the policy it names.

GraphnAI never unlinks the default domain policies. If an account's control of one is the problem, the fix removes the account's control instead.

Configuration

These server settings are for your GraphnAI administrator. The defaults suit most installations.

Setting Default What it does
Edit-check staleness limit 72 hours How long the attack path analysis behind the edit checks may keep failing before those checks read Not assessed. Range 1 to 720 hours.
SYSVOL staleness limit 168 hours (7 days) How old a domain's last successful SYSVOL read may be before the file checks read Not assessed. Range 1 to 720 hours.
Group Policy row cap 50,000 The most rows a Group Policy query reads per connector in one pass. A query over the cap makes its checks read Not assessed for that pass. Range 1,000 to 500,000.

Values outside the range are clamped, and the server logs a warning.

Troubleshooting

Every Group Policy check reads Not assessed after an upgrade

That's expected for a short time. The edit checks fill in after the next attack path analysis. The file checks need an updated bridge and its first full SYSVOL read.

The edit checks stay Not assessed

Check that attack path analysis is on. If the analysis keeps failing, the reason says so after the configured limit. Open Platform Health for the cause.

The file checks stay Not assessed

Check the Bridges page for Update this bridge for Group Policy checks. If it's absent, check that the bridge can read SYSVOL, and that its last read was within the staleness limit.

A check reads Not assessed for one pass only

A Group Policy query returned more rows than the row cap, so the check wasn't run over part of the data. Ask your GraphnAI administrator to raise the Group Policy row cap if it recurs.

That's expected. Remove the account's control of the default policy instead.

The container no longer exists

The finding names a container that was deleted. Refresh after the next analysis.

    ↑↓ to move, Enter to open