Group Policy is a fleet control plane
Group Policy can change settings, run scripts and install software across every machine in the estate.
That makes it one of the most powerful capabilities in a Windows environment and an obvious target: an attacker who can edit policy can deploy to everything at once, legitimately. It is a deployment mechanism, and it deserves the controls a deployment pipeline would get.
More on Windows and Active Directory
- Domain Admin is a forest-scale keyOne root under the whole forest
- Kerberos tickets are credentialsWhoever holds it, gets in
- Golden Ticket attacks target the ticket authorityThey took the press, not a ticket
- LAPS reduces shared local-admin secretsOne secret, or one each
- NTLM fallback preserves older trust assumptionsThe hatch nobody bricked up
- Service accounts can become invisible administratorsThe pass with no face