Group Policy artifacts

What it is

Group Policy distributes configuration from Active Directory to every domain machine and user. Policies live as files in SYSVOL on domain controllers and are cached and applied on each client. Because one GPO can push settings, scripts, scheduled tasks and software to thousands of hosts at once, attackers who gain directory control weaponise Group Policy for domain-wide persistence and ransomware deployment. Group Policy artifacts let an investigator see what was applied, when, and whether a policy object was tampered with.

Location

What it proves

• Which GPOs applied to a host or user, from the History keys and gpresult.
• What a policy contained: registry settings, scheduled tasks, services, scripts and installed software.
• Tampering: an unexpected ScheduledTasks.xml or script in a GPO, or a bumped version number, evidences a weaponised policy.
• It does not prove a policy actually executed on a given host without corroboration; combine with client-side execution artifacts. History keys show assignment and last apply, not per-user outcome.

Key fields

Timestamps

Registry.pol and the GPP XML files carry NTFS $SI/$FN times (UTC on disk); a recently modified ScheduledTasks.xml inside a long-standing GPO is a strong lead. The History registry keys expose a LastWrite time (UTC) for the last apply. Cross-reference with the GroupPolicy Operational event log.

Retention and clearing

SYSVOL content and the client cache persist until the GPO is edited or deleted; deleting a GPO removes its {GUID} folder but shadow copies and DC backups usually retain it. The History registry keys survive reboots and are a durable record of what applied even after the source GPO is gone.

Collection

gpresult /h C:\case\gpresult.html /f
Get-GPO -All | Select DisplayName, Id, ModificationTime, GpoStatus
robocopy \\%USERDNSDOMAIN%\SYSVOL\%USERDNSDOMAIN%\Policies E:\case\Policies /E /COPY:DAT

Also export the Group Policy\History keys from the client registry hives and collect the GroupPolicy Operational event log.

Parsing tools

• gpresult / rsop.msc (built in): the resultant set of policy for a host or user.
• GroupPolicy PowerShell module (Get-GPO, Get-GPOReport): inventory GPOs and their last modification time; run on a DC or with RSAT.
• RegRipper / Registry Explorer: parse the History keys and read Registry.pol.
• Get-GPPPassword and similar auditing scripts decrypt legacy GPP cpassword values so you can assess exposure; named factually for defenders.

Investigation tips

• GPP passwords: any surviving cpassword in Groups.xml, Services.xml or ScheduledTasks.xml is decryptable and was a classic credential source; flag and rotate the affected accounts.
• Weaponised GPO: attackers add an immediate scheduled task or startup script to a widely linked GPO to run a payload across the domain in one cycle. Diff GPO contents against a known-good backup and check ScheduledTasks.xml modification times.
• On the DC, 5136 (directory object modified) and 5137 (created) in the Security log capture GPO and link changes; correlate with the account that made them and with DCSync-era activity.
• The GroupPolicy Operational channel records apply cycles (start/finish and errors); confirm the current event IDs for your build rather than assuming, as they vary.
• New or unexpected GPO GUIDs, or a GPO linked at the domain root just before an incident, deserve close review; tie the change time to lateral movement.