Last updated: April 29, 2026
Why this module exists. Group Policy was designed in 2000 to centralise Windows administration. It’s still the primary configuration mechanism for AD-joined hosts in 2026. Attackers learned its weaknesses long ago; defenders mostly still don’t audit GPO ACLs. Three flavours of GPO abuse pay off in nearly every internal pentest.
The GPP cpassword bug — still relevant in 2026
Group Policy Preferences (introduced 2008) let admins push settings like “create a local admin account with this password.” The password was stored in the GPO XML, encrypted with AES-256 — using a published key. Microsoft shipped the key in MSDN documentation.
The result: any domain user could read the GPO XML and decrypt the password. Microsoft patched in MS14-025 (2014) — but only stopped creating new GPP password entries. Existing entries were left untouched. To this day, in roughly 30% of large enterprise pentests, you find legacy GPP cpasswords.
# Find GPP cpasswords from any domain user
Get-DomainGPPPassword
# Or with PowerView
Find-DomainShare -CheckShareAccess
# SYSVOL share readable by all domain users
# Walk SYSVOL for *.xml, grep cpassword
# Decrypt
gpp-decrypt 'cpassword_value'The decrypted password is often a domain admin or a service account. Game over.
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.