Active Directory Security

Group Policy Objects (GPOs) are one of the most powerful features in Active Directory. They allow administrators to manage settings across computers and users.

But if the wrong user has control over a GPO, it can become an easy privilege escalation path.

In this lab, I’ll use BloodHound to identify a dangerous GPO permission and then show how to fix it.

Lab Setup

• Domain: LAB.LOCAL
• Domain Controller: 192.168.56.104
• Attacker: Kali Linux
• User: bob

Step 1 — Collect Active Directory Data

First, I collected information from Active Directory using BloodHound.py.

bloodhound-python -u bob -p 'password@123' -d lab.local -ns 192.168.56.104 -c All --zip

BloodHound successfully collected:

• 8 Users
• 55 Groups
• 3 GPOs
• 2 OUs
• 1 Computer

Step 2 — Import into BloodHound

Next, I uploaded the generated ZIP file into BloodHound Community Edition.

BloodHound maps relationships between users, groups, computers, OUs, and GPOs, making it much easier to spot privilege escalation paths.

Step 3 — Finding the Misconfiguration

BloodHound showed that Bob had WriteDacl, WriteOwner, and GenericWrite permissions over the Employees Policy GPO.

These permissions are dangerous because they allow a user to modify who controls the GPO or change its configuration.

Why Is This Dangerous?

If an attacker can edit a GPO linked to an Organizational Unit (OU), they may be able to:

• Execute scripts on domain computers
• Deploy scheduled tasks
• Add users to local Administrators
• Push malicious registry changes
• Gain higher privileges across the domain

A single misconfigured GPO can impact many systems at once.

Step 4 — Fixing the Issue

On the Domain Controller:

Group Policy Management
        ↓
Employees Policy
        ↓
Delegation

Review who has permissions on the GPO.

Remove unnecessary permissions such as:

• GenericWrite
• misconfiguredWriteDacl
• WriteOwner

Only trusted administrators should have these rights.

Verify the Fix

Run BloodHound again after updating the permissions.

bloodhound-python -u bob -p 'password@123' -d lab.local -ns 192.168.56.104 -c All --zip

Re-import the ZIP into BloodHound.

The dangerous permission edges should no longer appear for Bob.

Key Takeaways

1.Regularly audit GPO permissions.

2. Use the principle of least privilege.

3. Review BloodHound findings periodically.

4. Remove unnecessary GenericWrite, WriteDacl, and WriteOwner permissions.

Disclaimer: The techniques demonstrated in this article were performed in a private Active Directory lab for learning purposes. Always obtain proper authorization before testing any production environment.

— Written by

Aruvasaga Chithan A

Ethical Hacker & Cyber Security Researcher.

Thanks for reading — your support keeps me writing.
See you in the next article…

Linkedin.