GPO links decide where a policy applies. The link is stored in the gPLink attribute on the domain, OU, or site object, not on the GPO itself. If we can modify gPLink, we can point an existing policy at a new scope.
Enumerate links
Get-ADObject -LDAPFilter '(&(|(objectClass=organizationalUnit)(objectClass=domainDNS))(gPLink=*))' -Properties gPLink,gPOptions |
Select-Object DistinguishedName,gPLink,gPOptions
PowerShell inheritance view
Get-GPInheritance -Target "DC=ootw,DC=local"
Get-GPInheritance -Target "OU=Workstations,OU=OOTW Lab,DC=ootw,DC=local"
Create a link
New-GPLink -Name "Misconfigured Policy" -Target "OU=Workstations,OU=OOTW Lab,DC=ootw,DC=local" -LinkEnabled Yes
Force an enforced link
Set-GPLink -Name "Misconfigured Policy" -Target "OU=Workstations,OU=OOTW Lab,DC=ootw,DC=local" -Enforced Yes
Disable a link
Set-GPLink -Name "Misconfigured Policy" -Target "OU=Workstations,OU=OOTW Lab,DC=ootw,DC=local" -LinkEnabled No
Remove a link
Remove-GPLink -Name "Misconfigured Policy" -Target "OU=Workstations,OU=OOTW Lab,DC=ootw,DC=local"
LDAP view from Linux
ldapsearch -LLL -x -H ldap://10.10.10.200 -D "ootw.local\\student" -w 'student' -b "DC=ootw,DC=local" '(&(|(objectClass=organizationalUnit)(objectClass=domainDNS))(gPLink=*))' distinguishedName gPLink gPOptions
Find links for one GUID
ldapsearch -LLL -x -H ldap://10.10.10.200 -D "ootw.local\\student" -w 'student' -b "DC=ootw,DC=local" '(&(|(objectClass=organizationalUnit)(objectClass=domainDNS))(gPLink=*{31B2F340-016D-11D2-945F-00C04FB984F9}*))' distinguishedName gPLink
Trigger policy refresh
Invoke-GPUpdate -Computer ws01.ootw.local -Force -RandomDelayInMinutes 0
Notes
Link abuse is noisy because it modifies the target OU or domain object. Watch gPLink and gPOptions.
Link order, enforced links, blocked inheritance, security filtering, and WMI filters can all change the final result.