auditing-group-policy-and-sysvol-trustlisted

# Auditing group policy and SYSVOL trust: when a writable policy runs on every machine Group policy is a domain-wide instruction stream: a policy object names settings, scripts, scheduled tasks, and software, its files live on a share every domain machine reads, and its links decide which machines apply it. Machines apply that policy with high privilege and largely without questioning it. That is safe only when nobody below a domain administrator can change what a policy says, where its files live, or which machines it targets. When a low-privileged principal can write a policy object, edit its files on the share, or alter its link, they run their own scripts and tasks on every machine in scope. A second failure hides in the content itself: a credential stored in a policy file that every domain user can read, or an unsigned policy file a machine applies without verifying its origin. The bug is trust in policy content or scope that a non-administrator can influence. You audit these by reading who can write each policy, its share files, and its links, and what the content discloses. ## When to use - Policy objects, their files on the domain share, or their links may be writable by non-administrators. - A policy file on the share may carry a stored credential readable by any domain user. - Policy files may be applied without verifying their origin or may be world-readable on the share. ## Scope check Audit policy and share trust only in directories you own or are authorized