AD-GPP-001: Passwords in Group Policy Preferences¶

high   Group Policy   MITRE ATT&CK T1552.006   Reads: SYSVOL (SMB)

Group Policy Preferences files in SYSVOL hold cpassword values, encrypted with a key Microsoft published, so every domain user can read and decrypt the passwords.

Also known as: gpp-password, cpassword

Why it matters¶

Before May 2014, Group Policy Preferences (GPP) could set passwords for local users, services, scheduled tasks, mapped drives and data sources. The password is stored in the preference XML under SYSVOL as cpassword, AES-256 encrypted with a key Microsoft documented in the MS-GPPREF specification. SYSVOL is readable by every authenticated user.

1. Any domain user lists SYSVOL and finds cpassword in, for example, a Groups.xml.
2. They decrypt it offline (gpp-decrypt, PowerSploit Get-GPPPassword, NetExec's gpp_password module).
3. The password is usually a local administrator password set on every workstation, or a service account's, which gives lateral movement or more.

MS14-025 removed the password fields from the GPMC editor, but it did not delete existing files: preference items created before the update stay in SYSVOL and keep applying until someone removes them.

How ad-doctor detects it¶

ad-doctor connects to the SYSVOL share over SMB as the scanning user and walks <domain>\Policies. In every Groups.xml, Services.xml, ScheduledTasks.xml, DataSources.xml, Drives.xml and Printers.xml (machine and user side) it looks for items with a non-empty cpassword="..." attribute and records the account name from userName, accountName, runAs or newName (? when none is present).

The value is never decrypted, stored or printed. Each object is the file path relative to SYSVOL and the account, for example Policies\{4B1D7A55-0C1E-4A3B-9D2F-7E6A5C3B2A10}\Machine\Preferences\Groups\Groups.xml (localadmin). Files the scanning user cannot read are skipped and listed in the scan notes.

Severity¶

Always high: the decryption key is public, the files are readable by every authenticated user, and the passwords are typically those of local administrator or service accounts.

False positives and limits¶

• Orphaned GPO folders. A file in a GPO folder whose GPO was deleted no longer applies, but the password in it is still readable and still needs changing.

Fix¶

1. Find every file (read-only):

   Get-ChildItem "\\$env:USERDNSDOMAIN\SYSVOL\$env:USERDNSDOMAIN\Policies" -Recurse -Include *.xml |
       Select-String -Pattern 'cpassword="[^"]+' -List | Select-Object Path
   

2. Change the passwords first: assume every account named in the finding is compromised, because any user could have read it at any time.

3. Delete the preference items in GPMC (or remove the XML files from the GPO folders), and confirm the files are gone from SYSVOL on every DC after replication.

4. Manage local administrator passwords with Windows LAPS and service account passwords with gMSAs instead of distributing a shared password.

Verify¶

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-GPP-001

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-GPP-001"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

Related checks¶

• AD-GPP-002
• AD-ACC-008
• AD-GPO-005

References¶

Microsoft and vendors

• MS14-025: Vulnerability in Group Policy Preferences could allow elevation of privilege
• Windows LAPS overview

Specifications

• [MS-GPPREF]: Password encryption

Research

• Finding passwords in SYSVOL & exploiting Group Policy Preferences (Sean Metcalf)

MITRE ATT&CK

• T1552.006

Available since 0.1.0.