Operator On The Wire
← Back to Knowledge Base
OOTW / Chapter IV - Active Directory / 04. Techniques / GPO / Techniques

GPO Links

GPO links decide where a policy applies. The link is stored in the gPLink attribute on the domain, OU, or site object, not on the GPO itself. If we can modify gPLink, we can point an existing policy at a new scope.

Enumerate links

Get-ADObject -LDAPFilter '(&(|(objectClass=organizationalUnit)(objectClass=domainDNS))(gPLink=*))' -Properties gPLink,gPOptions |
  Select-Object DistinguishedName,gPLink,gPOptions

PowerShell inheritance view

Get-GPInheritance -Target "DC=ootw,DC=local"
Get-GPInheritance -Target "OU=Workstations,OU=OOTW Lab,DC=ootw,DC=local"

Create a link

New-GPLink -Name "Misconfigured Policy" -Target "OU=Workstations,OU=OOTW Lab,DC=ootw,DC=local" -LinkEnabled Yes

Force an enforced link

Set-GPLink -Name "Misconfigured Policy" -Target "OU=Workstations,OU=OOTW Lab,DC=ootw,DC=local" -Enforced Yes

Disable a link

Set-GPLink -Name "Misconfigured Policy" -Target "OU=Workstations,OU=OOTW Lab,DC=ootw,DC=local" -LinkEnabled No

Remove a link

Remove-GPLink -Name "Misconfigured Policy" -Target "OU=Workstations,OU=OOTW Lab,DC=ootw,DC=local"

LDAP view from Linux

ldapsearch -LLL -x -H ldap://10.10.10.200 -D "ootw.local\\student" -w 'student' -b "DC=ootw,DC=local" '(&(|(objectClass=organizationalUnit)(objectClass=domainDNS))(gPLink=*))' distinguishedName gPLink gPOptions

Find links for one GUID

ldapsearch -LLL -x -H ldap://10.10.10.200 -D "ootw.local\\student" -w 'student' -b "DC=ootw,DC=local" '(&(|(objectClass=organizationalUnit)(objectClass=domainDNS))(gPLink=*{31B2F340-016D-11D2-945F-00C04FB984F9}*))' distinguishedName gPLink

Trigger policy refresh

Invoke-GPUpdate -Computer ws01.ootw.local -Force -RandomDelayInMinutes 0

Notes

Link abuse is noisy because it modifies the target OU or domain object. Watch gPLink and gPOptions.

Link order, enforced links, blocked inheritance, security filtering, and WMI filters can all change the final result.