A transit AD assessment discovers a Group Policy Object that is writable by a low-privilege group and linked to OUs holding high-value servers. How should the tester frame the finding?
Select an answer to reveal the explanation.
Short Explanation
If someone can edit a GPO aimed at the servers that run the transit system, they can push settings those machines will obey. That is escalation in AD clothing — not a wallpaper joke. Who can write GPOs linked to crown-jewel OUs is a core control question.
Full Explanation
A Group Policy Object writable by a low-privilege group and linked to OUs holding high-value transit servers is a privilege-escalation path. Edit rights on such GPOs can push harmful configurations, scheduled tasks, or software settings onto important systems—often a faster route to control than hunting obscure ACLs elsewhere. Priority attention is warranted in municipal AD path reviews.
Writable GPOs are not limited to desktop wallpaper. GPO edit rights matter even without preexisting Domain Admin—the write right is the escalation. SYSVOL permissions matter too, but claiming only SYSVOL matters while GPO ACLs cannot change machine behavior is incorrect; GPO is a primary configuration delivery mechanism.
Exam caveat: always note link scope (which OUs) when rating GPO write findings—links to server OUs elevate severity for civic critical systems. CPTS path analysis treats GPO control like code execution deferred through policy.
Operational check: review GPO ACLs and links, remove low-privilege write, monitor GPO changes, and verify high-value server OUs only accept policy from tightly controlled admin groups. Treat GPO write findings on server OUs as near-code-execution paths in the transit AD report and assign remediation owners before lower-severity ACL noise.