The GPLink relationship connects a Group Policy Object (GPO) to an AD Domain, organizational unit (OU), or Site it is linked to.
For a Domain or OU, the GPO’s settings apply to users and computers in that scope, including nested OUs. For a Site, they apply to the site’s domain controllers and to computers whose IP addresses fall within one of the site’s subnets. The default site also covers computers that do not map to another site. User-side settings affect users who sign in to those computers.
The Enforced property on the edge indicates whether the GPO link is enforced, meaning it still applies if an OU has blocked GPO inheritance.
Abuse Info
Control over the GPO can be abused to compromise the AD accounts the GPO applies to by modifying the GPO policy settings. Refer to A Red Teamer’s Guide to GPOs and OUs for details about the abuse technique, and check out the following tools for practical exploitation:- Windows: SharpGPOAbuse
- Linux: pyGPOAbuse
Opsec Considerations
There is no opsec information for this edge.Edge Schema
Source: GPODestination: Domain, OU, Site
Traversable: ✅