A municipal GPO broadly disables Defender-class endpoint protections across domain-joined hosts. What should the assessment report?
Select an answer to reveal the explanation.
Short Explanation
Turning off the smoke alarms from a central switch does not make the building safer — it just makes fires quieter until they are huge. GPOs that kill endpoint defenses grease AD paths. Call that out as directory-delivered weakening.
Full Explanation
Group Policy that broadly disables Defender-class endpoint protections across domain-joined hosts enlarges the likelihood of successful Active Directory attack paths. For a municipality, weakening EDR/AV via GPO makes credential theft, malware persistence, and lateral tooling easier on the same endpoints that authenticate users into AD—raising identity-plane risk through host compromise probability.
Disabling protections does not “improve AD performance” in any justified hardening sense. Security product GPO settings are not cosmetic; they materially change attacker and tester success rates. GPO absolutely can influence endpoint defense configuration—claiming only local registry edits matter is incorrect.
Exam caveat: report defensive GPO weakening as an AD-path enabler and host-hardening failure, not as a standalone “AV vendor” debate. CPTS AD engagements often note how endpoint posture accelerates or blocks path progression.
Operational check: identify GPOs that disable or weaken protections, restore secure baselines through change control, verify coverage on civic workstations, and reassess how much harder common credential-theft steps become afterward. Endpoint defense GPOs are part of the municipality’s AD resilience story because host compromise is often the on-ramp to directory privilege.