gpo-abuse

Enumerate GPO names (powerview)

Get-DomainGPO | select displayname

Get-GPO -All | Select DisplayName

OR

get-gpo -name "Default Domain Policy"

Enumerate domain user GPO rights

$sid = Convert-NameToSid "Default Domain Policy"

Get-DomainGPO | Get-ObjectAcl | ?{$_.SecurityIdentifier -eq $sid}

Tool to abuse GPO misconfiguration

• SharpGPOAbuse