GPOADmin

GPO management is one of the most important aspects of IT security. Almost every organization uses GPOs to configure and secure Active Directory. GPOs are built into every copy of Windows, so there isn’t anything that needs installing to use it. GPO management can control everything from password policy to Start menu layouts, and can be granularly applied so that particular settings are applied to only the right users and computers.

There are many specific examples of what can be managed through GPOs.

• Lock an account after a certain number of incorrect passwords are entered.
• Block unidentified users on remote computers from connecting to a network share.
• Provide all business users a standard set of bookmarks so they can easily reach your helpdesk or access other important resources.
• Restrict access to certain folders.
• Install the same software on all of your domain controllers (DCs).
• Disable the command prompt on users’ machines.
• Ensure Windows updates are applied promptly.
• Disable use of the NTLM v1 authentication protocol (which is weaker than Kerberos).

GPO management is important now more than ever because Active Directory Group Policy is an attractive target for hackers, and vulnerable on multiple fronts. First, it’s an open book. The design of Active Directory ensures that every user can see the policies you have, where they’re applied and who has access to them. IT teams usually use descriptive names for objects in Active Directory, which keeps things simple for them, but gives hackers critical information to exploit. Second, it’s often a “set it and forget it” technology. Group Policy management is very complex, with thousands of policies, delegations & modifications to manage. It can be incredibly hard to untangle and it’s risky to remove policies and delegated admins without proper research. As a result, too many organizations don’t even try. That leaves their IT ecosystem extremely vulnerable.