Lesson 4.24: Reviewing SYSVOL for secrets
SYSVOL is the share on every domain controller that holds Group Policy files and logon scripts, and every domain user can read it. Over the years it collects things that shouldn't be there: old Group Policy Preferences with a 'cpassword' attribute (its encryption key was published by Microsoft, so it's effectively plain text) and scripts with passwords written in. In the lab you search SYSVOL for both, identify the old GPO and where it's linked, see in the file-share audit that the attacker read those very files, and remove them. The passwords themselves are changed, never decrypted.
16 min
You will learn to
- Explain what SYSVOL holds and who can read it
- Find Group Policy Preference passwords
- Map a GPO GUID to its name and links
- Find passwords in logon scripts
- Remove secrets and rotate the passwords
Key terms
- SYSVOL
- Share replicated to every DC with Group Policy templates (Policies) and logon scripts (scripts).
- Group Policy Preferences (GPP)
- GPO extensions that set things like local users, drives and tasks, stored as XML in SYSVOL.
- cpassword
- Attribute in GPP files holding a password encrypted with a key Microsoft published; treat as plain text.
- Event 5145
- A network share object was checked for access: which file on which share, by whom, from where.
- GPT.INI
- Version file of a GPO in SYSVOL; clients reapply a GPO when its version changes.
← Cross-site scripting (XSS) · All lessons · Zeek connection logs →