GPO Execution Sanity

CSEs are components that generally will be executed with very high privileges on a domain machine during the GPO application. Hence, it is essential to ensure that every Client-Side Extension (CSE) contained in a GPO is sane and has been certified by a trusted party.

It is also crucial that all GPO files retrieved by domain computers originate from a safe place, before anything is applied.

You should identify unknown CSEs in the registry of a machine that applies the GPO, remove those that are dangerous, and whitelist those that you confirmed as legitimate. The GpcFileSysPath attribute should point towards a safe location such as the SYSVOL share.

Name: GPO Execution Sanity

Codename: C-GPO-EXEC-SANITY

Severity: High

Type: Active Directory Indicator of Exposure

Family: Policy and Configuration