GPO LDAP queries map policy containers, SYSVOL paths, OU/domain links, and WMI filters that can change where a GPO actually applies. We use this before inspecting SYSVOL content or deciding whether a policy reaches a target host.
export DC=10.10.10.200
export BASE='DC=ootw,DC=local'
export CONFIG='CN=Configuration,DC=ootw,DC=local'
export DOMAIN=ootw.local
export USER='student'
export PASS='student'
Enumerate GPOs:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(objectClass=groupPolicyContainer)' displayName name gPCFileSysPath gPCWQLFilter whenChanged
Enumerate GPO links:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(|(objectClass=organizationalUnit)(objectClass=domain))(gPLink=*))' objectClass name distinguishedName gPLink gPOptions
Find links for one GPO GUID:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(|(objectClass=organizationalUnit)(objectClass=domain))(gPLink=*{DFE606B4-CA59-4AD6-9BCE-55AF35888129}*))' objectClass name distinguishedName gPLink
Enumerate WMI filters:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "CN=SOM,CN=WMIPolicy,CN=System,$BASE" '(objectClass=msWMI-Som)' name msWMI-Name msWMI-Parm2 distinguishedName
GPOs with WMI filters:
ldapsearch -LLL -x -H ldap://$DC -D "$DOMAIN\\$USER" -w "$PASS" -b "$BASE" '(&(objectClass=groupPolicyContainer)(gPCWQLFilter=*))' displayName gPCWQLFilter gPCFileSysPath
Download common policy files:
smbclient "//$DOMAIN/SYSVOL" -U "$DOMAIN\\$USER%$PASS" -c 'recurse ON; ls'
smbclient "//$DOMAIN/SYSVOL" -U "$DOMAIN\\$USER%$PASS" -c 'get ootw.local/Policies/{GUID}/Machine/Microsoft/Windows NT/SecEdit/GptTmpl.inf'
smbclient "//$DOMAIN/SYSVOL" -U "$DOMAIN\\$USER%$PASS" -c 'get ootw.local/Policies/{GUID}/Machine/Registry.pol'
PowerShell:
Get-GPO -All | Select-Object DisplayName,Id,Path,WmiFilter
Get-ADObject -LDAPFilter '(&(|(objectClass=organizationalUnit)(objectClass=domain))(gPLink=*))' -Properties gPLink,gPOptions
Get-ADObject -SearchBase "CN=SOM,CN=WMIPolicy,CN=System,DC=ootw,DC=local" -LDAPFilter '(objectClass=msWMI-Som)' -Properties msWMI-Name,msWMI-Parm2