> For the complete documentation index, see [llms.txt](https://otter.gitbook.io/red-teaming/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://otter.gitbook.io/red-teaming/notes/powershell/powershell-snippets/enumerate-with-gpos.md).

# Enumerate with GPOs

This script does the following

1. Find the default age (in hours) for Kerberos tickets in the domain
2. Find users and groups with `SeEnableDelegationPrivilege` on the DC (or DCs)
3. Find what GPOs are applied to the DC
4. Enumerates GPOs for workstations and servers

```powershell
# import PowerView
Import-Module ..\PowerView.ps1

# domain Kerberos settings
$Settings = Get-DomainPolicyData -Policy 'Domain'
$Settings.KerberosPolicy

# who has SeEnableDelegationPrivilege over the DC
$Settings = Get-DomainPolicyData -Policy 'DomainController'
$Settings.PrivilegeRights

# what GPOs are applied to the domain controller
$DomainController = (Get-DomainController).Name
Get-DomainGPO -ComputerIdentity $DomainController

# enumerate all GptTmpl.inf settings for GPOs in the domain
Get-DomainGPO | Get-DomainPolicyData

# find any GPOs that modify local group memberships through GPOs
Get-DomainGPOLocalGroup

# to find what machines an "interesting" GPO applies to
Get-DomainGPO WorkstationGPO | %{Get-DomainOU -GPLink $_.Name} | % {Get-DomainComputer -SearchBase $_.distinguishedname -Properties dnshostname}
Get-DomainGPO ServerGPO | %{Get-DomainOU -GPLink $_.Name} | % {Get-DomainComputer -SearchBase $_.distinguishedname -Properties dnshostname}
```

References:

* [Interfacing with AD](/red-teaming/notes/powershell/interfacing-with-ad.md)
* [GPOs](/red-teaming/notes/active-directory/gpos.md)