Skip to content

AD-GPO-003: Weak security settings in GPOs applied to DCs or the domain

medium high   Group Policy   MITRE ATT&CK T1557, T1003   Reads: SYSVOL (SMB), LDAP

A GPO applied to the domain or the domain controllers allows LM or NTLMv1, stores LM hashes or reversibly encrypted passwords, or hands SYSTEM-level privileges to non-admins.

Why it matters

The security template of a GPO linked to the domain head or the Domain Controllers OU sets how domain controllers (and, for a domain link, every computer) authenticate and who holds powerful privileges there:

Setting in GptTmpl.inf Why it matters
LmCompatibilityLevel 0 to 2 LM and NTLMv1 responses are accepted or sent; an attacker who coerces a DC to authenticate gets an NTLMv1 response that can be cracked to the DC's NT hash, then DCSync
NoLMHash = 0 LM hashes, split into two 7-character DES halves and trivial to crack, are stored at the next password change
ClearTextPassword = 1 Passwords are stored with reversible encryption, so DCSync or a DC backup yields the plain text
SeDebugPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeTakeOwnershipPrivilege, SeLoadDriverPrivilege, SeTcbPrivilege, SeCreateTokenPrivilege, SeSecurityPrivilege, SeEnableDelegationPrivilege for a non-admin Each is a documented route to SYSTEM, to reading NTDS.dit, or (SeEnableDelegation) to configuring delegation

A privilege granted on a DC is a privilege over the domain.

How ad-doctor detects it

ad-doctor reads each GPO's GptTmpl.inf from SYSVOL and keeps the GPOs that have an enabled link on the domain head or on OU=Domain Controllers and that Windows would actually apply: the computer side is not disabled, the computer version is not 0 and the security client-side extension is listed in gPCMachineExtensionNames. It then reports:

  • MACHINE\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel below 3;
  • ...\Lsa\NoLMHash set to 0;
  • ClearTextPassword = 1 in [System Access];
  • any of the privileges above granted in [Privilege Rights] to a principal other than the tier-0 groups, the operator groups, SYSTEM, LOCAL SERVICE and NETWORK SERVICE.

Objects look like LabDCPolicy: LmCompatibilityLevel 1 (LM/NTLMv1 allowed), LabDCPolicy: LM hashes stored (NoLMHash 0), LabDCPolicy: reversible password encryption enabled or LabDCPolicy: SeDebugPrivilege granted to Authenticated Users.

The check judges each GPO on its own: it does not compute precedence, so a weak value overridden by a higher-precedence GPO is still reported, and settings made outside Group Policy (local policy, registry) are not seen.

Attributes and probes read
  • Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf: [System Access], [Registry Values], [Privilege Rights]
  • gPLink on the domain head and OU=Domain Controllers (enabled links)
  • flags, versionNumber, gPCMachineExtensionNames of each GPO

Severity

High when any reported GPO allows LM or NTLMv1 (LmCompatibilityLevel below 3), enables reversible password encryption, or grants a dangerous privilege beyond its default holders. Medium when the only problem found is NoLMHash = 0 (LM hashes stored at the next password change).

False positives and limits

  • Overridden settings. A weak value in a low-precedence GPO that a stronger GPO overrides still has no effect today; it takes effect as soon as the other GPO is unlinked. Fix it anyway or confirm with gpresult /h on a DC.
  • Principals written by name. A [Privilege Rights] entry that names an account instead of its SID (*S-1-...) is compared as a name and may be reported even for an administrator group.
  • Delegated audit-log access (SeSecurityPrivilege for a SIEM or Exchange group) is a known pattern, but it lets that group clear the Security log of every DC. Accept it with an owner if deliberate (../ci.md#accepted-risks).

Fix

  1. See the effective settings in the GPO (read-only):

    Get-GPOReport -Name 'LabDCPolicy' -ReportType Html -Path .\LabDCPolicy.html

  2. Fix the values in GPMC under Computer Configuration > Policies > Windows Settings > Security Settings:

    • Local Policies > Security Options > Network security: LAN Manager authentication level: Send NTLMv2 response only. Refuse LM & NTLM (level 5), after checking the NTLM audit logs for clients that still need NTLMv1.
    • Network security: Do not store LAN Manager hash value on next password change: Enabled.
    • Account Policies > Password Policy > Store passwords using reversible encryption: Disabled, then reset the passwords of accounts that changed it while it was on.
    • Local Policies > User Rights Assignment: limit each reported privilege to its default holders (Administrators; Backup Operators for backup and restore).

  3. Run gpupdate on a DC and confirm with gpresult /h that the new values win.

Verify

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-GPO-003

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-GPO-003"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

References

Microsoft and vendors

MITRE ATT&CK

Available since 0.1.0.