Viewing GPO's On The Commandline PDF

4/11/2017 ViewingGPOsontheCommandline
Viewing GPOs on the Commandline

September 2, 2011 Redspin Penetration Testing, Security Tools
0 Comments
Want a quick way to see what GPOs are applied to your local
system, just using built in utilities? Using the GUI to manually view
what settings are applied is awkward and slow. ?Use the following
commands to see what policies are being handed down to the
system youre on and what theyre enforcing. ?This info can be
incredibly handy during a pentest in order to nd out the limitations
being imposed on a specic system youve compromised. It can
also be very valuable during a vulnerability assessment to spot-
check policies being passed down from the domain or forest a
workstation is a member of.
Open a command prompt and enter the following command to see

all GPOs that are being applied to your system:

gpresult
This will show the most basic output

C:Documents and Settingsbilly> gpresult
Microsoft (R) Windows (R) XP Operating

System Group Policy Result tool v2.0
Copyright (C) Microsoft Corp. 1981-2001
Created On 8/26/2011 at 3:24:13 PM
https://www.redspin.com/itsecurityblog/2011/09/viewinggposonthecommandline/ 1/14
RSOP results for MARSbilly on EARTH :

Logging Mode
-------------------------------------------
---------
OS Type: Microsoft
Windows XP Professional
OS Configuration: Member
Workstation
OS Version: 5.1.2600
Domain Name: MARS
Domain Type: Windows 2000
Site Name: Default-First-
Site-Name
Roaming Profile:
Local Profile: C:Documents
and Settingsbilly
Connected over a slow link?: No
COMPUTER SETTINGS
------------------
CN=EARTH,OU=Goats,DC=mars,DC=local
Last time Group Policy was applied:
8/26/2011 at 3:03:25 PM
Group Policy was applied from:
phobos.mars.local
Group Policy slow link threshold: 500
kbps
Applied Group Policy Objects

-----------------------------
Pasture.Rules
Good.Goats
Default Domain Policy
The following GPOs were not applied

because they were filtered out
---------------------------------------
----------------------------
Local Group Policy
Filtering: Not Applied (Empty)
The computer is a part of the following

security groups:
---------------------------------------
-----------------
BUILTINAdministrators
Everyone
NT AUTHORITYAuthenticated Users
USER SETTINGS
--------------
CN=Billy,OU=Goats,DC=mars,DC=local
8/26/2011 at 3:03:20 PM
phobos.mars.local
kbps

-----------------------------
Pasture.Rules
Good.Goats

---------------------------------------
----------------------------
Local Group Policy
The user is a part of the following

security groups:
---------------------------------------
-------------
Domain Users
Everyone
BUILTINUsers
NT AUTHORITYINTERACTIVE
LOCAL
To see additional detail including the specic settings within the

applied GPOs use the following command

gpresult /z

Microsoft (R) Windows (R) XP Operating
System Group Policy Result tool v2.0
Copyright (C) Microsoft Corp. 1981-2001
Created On 8/26/2011 at 3:35:13 PM
RSOP results for MARSbilly on EARTH :

Logging Mode
-------------------------------------------
---------
OS Type: Microsoft
Windows XP Professional
OS Configuration: Member
Workstation
OS Version: 5.1.2600
Domain Name: MARS
Domain Type: Windows 2000
Site Name: Default-First-
Site-Name
Roaming Profile:
Local Profile: C:Documents
and Settingsbilly
Connected over a slow link?: No
COMPUTER SETTINGS
------------------
CN=EARTH,OU=Goats,DC=mars,DC=local
8/26/2011 at 3:03:25 PM
phobos.mars.local
kbps

-----------------------------
Pasture.Rules
Good.Goats

---------------------------------------
----------------------------
Local Group Policy

The computer is a part of the following

security groups:
---------------------------------------
-----------------
BUILTINAdministrators
Everyone
Resultant Set Of Policies for Computer:

---------------------------------------
-
Software Installations
----------------------
N/A
Startup Scripts
---------------
N/A
Shutdown Scripts
----------------
N/A
Account Policies
----------------
GPO: Default Domain Policy
Policy:
MinimumPasswordAge
Computer Setting: 1

Policy:
PasswordHistorySize
Computer Setting: 24

Policy:
LockoutDuration

Policy:
ResetLockoutCount

Policy:
MinimumPasswordLength
Computer Setting: 7

Policy:
LockoutBadCount
Computer Setting: 5

Policy:
MaximumPasswordAge
Audit Policy
------------
GPO: Pasture.Rules
Policy:
AuditPolicyChange
Computer Setting: Success
GPO: Pasture.Rules
Policy:
AuditDSAccess
Computer Setting: Success,
Failure
GPO: Pasture.Rules
Policy:
AuditAccountLogon
Failure
GPO: Pasture.Rules
Policy:
AuditAccountManage
Computer Setting: Success
GPO: Pasture.Rules
Policy:
AuditLogonEvents
Failure
User Rights
-----------
N/A
Security Options
----------------
Policy:
RequireLogonToChangePassword
Computer Setting: Not
Enabled
GPO: Good.Goats
Policy:
EnableGuestAccount
Enabled

Policy:
PasswordComplexity
Computer Setting: Enabled

Policy:
ForceLogoffWhenHourExpire
Enabled

Policy:
ClearTextPassword
Enabled
Event Log Settings

------------------
N/A
Restricted Groups
-----------------
N/A
System Services
---------------
N/A
Registry Settings
-----------------
N/A
File System Settings

--------------------
N/A
Public Key Policies

-------------------
N/A
Administrative Templates
------------------------
N/A
USER SETTINGS
--------------
CN=Billy,OU=Goats,DC=mars,DC=local
8/26/2011 at 3:03:20 PM
phobos.mars.local
kbps

-----------------------------
Pasture.Rules
Good.Goats

---------------------------------------
----------------------------
Local Group Policy

security groups:
---------------------------------------
-------------
Domain Users
Everyone
BUILTINUsers
LOCAL
Resultant Set Of Policies for User:

------------------------------------
Software Installations
----------------------
N/A
Public Key Policies

-------------------
N/A
Administrative Templates
------------------------
GPO: Good.Goats
Setting:
SoftwareMicrosoftWindowsCurrentVersionPolic
iesExplorer
State: Enabled
GPO: Good.Goats
Setting:
iesUninstall
State: Enabled
GPO: Pasture.Rules
Setting:
SoftwarePoliciesMicrosoftWindowsControl
PanelDesktop
State: Enabled
GPO: Good.Goats
Setting:
PanelDesktop
State: Enabled
GPO: Good.Goats
Setting:
PanelDesktop
State: Enabled
GPO: Good.Goats
Setting:
iesSystem
State: Enabled
GPO: Pasture.Rules
Setting:
PanelDesktop
State: Enabled
GPO: Pasture.Rules
Setting:
PanelDesktop
State: Enabled
GPO: Pasture.Rules
Setting:
PanelDesktop
State: Enabled
GPO: Good.Goats
Setting:
PanelDesktop
State: Enabled
GPO: Good.Goats
Setting:
iesUninstall
State: Enabled
Folder Redirection
------------------
N/A
Internet Explorer Browser User

Interface
-----------------------------------
-----
N/A
Internet Explorer Connection

----------------------------
N/A
Internet Explorer URLs

----------------------
N/A
Internet Explorer Security

--------------------------
N/A
Internet Explorer Programs

--------------------------
N/A
Data of particular interest to an attacker is output of the security

group information, which lists what security groups the user account
youre logged in as belongs to.

security groups:
---------------------------------------
-------------
Domain Users
Everyone
BUILTINUsers
LOCAL
In this example the user is just a member of the default groups and
is fairly restricted.
Other information of note is the output of Account Policies which
lists what password policies are in effect for the workstation as well
as the domain. This can help gauge what type of password
guessing you can perform against other machines on the domain

without locking accounts out.

Account Policies
----------------
Policy:
MinimumPasswordAge
Computer Setting: 1

Policy:
PasswordHistorySize

Policy:
LockoutDuration

Policy:
ResetLockoutCount

Policy:
MinimumPasswordLength
Computer Setting: 7

Policy:
LockoutBadCount
Computer Setting: 5

Policy:
MaximumPasswordAge
All of this data can be accessed as a normal, limited user account

and reveals a wealth of information about the conguration of the
domain which the machine is joined to. This info can aid greatly in a
pentesters quest to gain further access into the network.
penetration test vulnerability assessment
vulnerability management
Share This Page
Related Posts
Converting Lots of Attacking Webmail Get a Meterpreter

PDFs to TXTs in User Accounts Shell Using SMB
Ubuntu/Debian Credentials
Webmail is
For those of you absolutely The Meterpreter
who are everywhere. I shell in
struggling to nd rarely come Metasploit is a
a way to convert across a fantastic way to
PDF les corporate interact with a
Leave a Reply
Your email address will not be published. Required elds are marked *
Name *
Email *
Website
Comment
Post Comment

Viewing GPO's On The Commandline PDF

Transféré par

Informations du document

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

Viewing GPO's On The Commandline PDF

Transféré par

Droits d'auteur :

Formats disponibles

4/11/2017 ViewingGPOsontheCommandline

Viewing GPOs on the Commandline

Open a command prompt and enter the following command to see

This will show the most basic output

Microsoft (R) Windows (R) XP Operating

Created On 8/26/2011 at 3:24:13 PM

RSOP results for MARSbilly on EARTH :

Applied Group Policy Objects

The following GPOs were not applied

The computer is a part of the following

Applied Group Policy Objects

The following GPOs were not applied

The user is a part of the following

To see additional detail including the specic settings within the

Created On 8/26/2011 at 3:35:13 PM

RSOP results for MARSbilly on EARTH :

Applied Group Policy Objects

The following GPOs were not applied

Local Group Policy

The computer is a part of the following

Resultant Set Of Policies for Computer:

GPO: Default Domain Policy

GPO: Default Domain Policy

GPO: Default Domain Policy

GPO: Default Domain Policy

GPO: Default Domain Policy

GPO: Default Domain Policy

GPO: Default Domain Policy

GPO: Default Domain Policy

GPO: Default Domain Policy

Event Log Settings

File System Settings

Public Key Policies

Applied Group Policy Objects

The following GPOs were not applied

The user is a part of the following

Resultant Set Of Policies for User:

Public Key Policies

Internet Explorer Browser User

Internet Explorer Connection

Internet Explorer URLs

Internet Explorer Security

Internet Explorer Programs

Data of particular interest to an attacker is output of the security

guessing you can perform against other machines on the domain

GPO: Default Domain Policy

GPO: Default Domain Policy

GPO: Default Domain Policy

GPO: Default Domain Policy

GPO: Default Domain Policy

GPO: Default Domain Policy

All of this data can be accessed as a normal, limited user account

penetration test vulnerability assessment

Share This Page

Converting Lots of Attacking Webmail Get a Meterpreter

Vous aimerez peut-être aussi