# Enumerate with GPOs

This script does the following

1. Find the default age (in hours) for Kerberos tickets in the domain
2. Find users and groups with `SeEnableDelegationPrivilege` on the DC (or DCs)
3. Find what GPOs are applied to the DC
4. Enumerates GPOs for workstations and servers

```powershell
# import PowerView
Import-Module ..\PowerView.ps1

# domain Kerberos settings
$Settings = Get-DomainPolicyData -Policy 'Domain'
$Settings.KerberosPolicy

# who has SeEnableDelegationPrivilege over the DC
$Settings = Get-DomainPolicyData -Policy 'DomainController'
$Settings.PrivilegeRights

# what GPOs are applied to the domain controller
$DomainController = (Get-DomainController).Name
Get-DomainGPO -ComputerIdentity $DomainController

# enumerate all GptTmpl.inf settings for GPOs in the domain
Get-DomainGPO | Get-DomainPolicyData

# find any GPOs that modify local group memberships through GPOs
Get-DomainGPOLocalGroup

# to find what machines an "interesting" GPO applies to
Get-DomainGPO WorkstationGPO | %{Get-DomainOU -GPLink $_.Name} | % {Get-DomainComputer -SearchBase $_.distinguishedname -Properties dnshostname}
Get-DomainGPO ServerGPO | %{Get-DomainOU -GPLink $_.Name} | % {Get-DomainComputer -SearchBase $_.distinguishedname -Properties dnshostname}
```

References:

* [Interfacing with AD](../interfacing-with-ad)
* [GPOs](../../active-directory/gpos)
