Belongs To GPO

Description

The Source GPO file or folder in the SYSVOL share belongs to the target GPC (GPO), which means that it defines the settings or programs/scripts that the GPO applies.

Exploitation

This is not an attack relation that an attacker would use in isolation. However, as an example, it can show complete attack paths where attackers who have control over a GPO file/folder belonging to a GPO can force arbitrary settings or launch scripts on the users/computers at the end of the attack path.

Remediation

This relation shows how GPO files and folders found in SYSVOL are related to the corresponding GPC (GPO) object. This is normal and by design.

Therefore, there is no need for remediation.

See also

• Add Key Credential

• Add Member

• Allowed To Act

• Allowed To Delegate

• DCSync

• Grant Allowed To Act

• Has SID History

• Implicit Takeover

• Inherit GPO

• Linked GPO

• Member Of

• Owns

• Reset Password

• RODC Manage

• Write DACL

• Write Owner