A municipal GPO broadly disables Defender-class endpoint protections across domain-joined hosts. What should the assessment report?
Select an answer to reveal the explanation.
Short Explanation
Turning off the smoke alarms from a central switch does not make the building safer — it just makes fires quieter until they are huge. GPOs that kill endpoint defenses grease AD paths. Call that out as directory-delivered weakening.
Full Explanation
Group Policy can centrally disable or degrade endpoint security controls, lowering the cost of host compromise and subsequent credential or lateral steps toward directory impact. That is a substantive misconfiguration, not cosmetic policy noise. Claims that GPO cannot influence defenses or that disablement helps performance are incorrect. Report security-tool weakening via directory policy as an AD-relevant finding.