Windows Security · 2.9

🗂️ Group Policy Objects (GPO)

The master control panel for every Windows security setting⏱ ~9 min

🏛️GPO is like a constitution for your computer

A constitution overrides ordinary laws — no law can contradict it. Group Policy is the same: a GPO setting overrides whatever you set in Windows Settings or Control Panel. If you disabled Windows Update via GPO, re-enabling it in Windows Settings does nothing. GPO is the highest authority in local Windows configuration.

What Is Group Policy?

Group Policy is a Windows feature that centrally controls hundreds of security settings through a single interface. The Local Group Policy Editor (gpedit.msc) manages policies for just one computer. In corporate environments, Group Policy is applied from a server to thousands of PCs simultaneously — but in CyberPatriot, you work with LOCAL group policy on the VM image.

secpol.msc (Local Security Policy)
  • •Subset of Group Policy
  • •Only covers: Account Policies, Local Policies, Windows Firewall, public key policies
  • •Easier to navigate for password/lockout settings
  • •Good for quick password and lockout changes
gpedit.msc (Local Group Policy Editor)
  • •Full superset — includes everything in secpol.msc plus much more
  • •Controls: Windows Update, AutoPlay, Remote Desktop, Defender, Software Restriction, and hundreds more
  • •Divided into Computer Configuration and User Configuration
  • •Use this when secpol.msc doesn't have the setting you need

Opening the Local Group Policy Editor

📍 Navigation Path
Press Win+R→Type: gpedit.msc→Press Enter
✓ Action: Opens Local Group Policy Editor
⚠ Warninggpedit.msc requires an Administrator account. If you get 'Windows cannot find gpedit.msc', you are on Windows Home edition — Home does not include Group Policy Editor. CyberPatriot competition images use Windows 10/11 Pro or Education, which always have it.

The Two Halves: Computer Configuration vs User Configuration

SideWhat It ControlsWhen It Applies
Computer ConfigurationSettings that apply to the machine regardless of who logs in — services, Windows Update, system-wide restrictionsApplied at Windows startup, before anyone logs in
User ConfigurationSettings that apply to the currently logged-in user — desktop restrictions, browser settings, mapped drivesApplied when a specific user logs in
🔒 SecurityIn CyberPatriot, Computer Configuration is where most vulnerabilities live. Focus there first. Attackers plant malicious settings in Computer Configuration because they apply to every user and survive reboots.

Navigating the Tree: Administrative Templates

Most competition-relevant settings are under Administrative Templates, which contains registry-based policies organized into categories. The path pattern is:

📍 Navigation Path
Computer Configuration→Administrative Templates→Windows Components→(specific feature)

Example 1 — Windows Update (Competition Vulnerability)

Competition images often have Windows Update disabled via Group Policy as an intentional vulnerability. Automatic updates are your first line of defense against exploits — disabling them is a critical misconfiguration. Here's how to find and fix it:

📍 Navigation Path
Computer Configuration→Administrative Templates→Windows Components→Windows Update→Manage end user experience→Configure Automatic Updates
✓ Action: Set to: Not Configured (or Enabled → Auto download and schedule install)
💡 TipIn the right pane, double-click the policy name. A dialog opens with three states: Not Configured, Enabled, Disabled. For 'Configure Automatic Updates', set it to 'Not Configured' to let Windows use its default (enabled) behavior — or 'Enabled' and choose option 4 (Auto download and schedule install).

Example 2 — Disable Remote Desktop via GPO

Remote Desktop (RDP) should be disabled unless the scenario specifically requires it. RDP is a common attack vector — leaving it on gives attackers a way in if they guess or steal a password.

📍 Navigation Path
Computer Configuration→Administrative Templates→Windows Components→Remote Desktop Services→Remote Desktop Session Host→Connections→Allow users to connect remotely using Remote Desktop Services
✓ Action: Set to: Disabled
powershell
# Alternative: disable RDP via registry (same effect as GPO)
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -Value 1
 
# Or via System Properties:
# Win+R → sysdm.cpl → Remote tab → select 'Don't allow remote connections to this computer'

Example 3 — Disable AutoPlay via GPO (CIS Level 1)

AutoPlay automatically runs software from USB drives, DVDs, and network drives when plugged in. CIS Level 1 requires it to be disabled — infected USB drives exploit AutoPlay to install malware automatically.

📍 Navigation Path
Computer Configuration→Administrative Templates→Windows Components→AutoPlay Policies→Turn off AutoPlay
✓ Action: Set to: Enabled → All Drives
💡 TipAfter enabling 'Turn off AutoPlay', set the dropdown to 'All Drives' — not just 'CD-ROM and removable media drives'. USB drives are the primary attack vector.

Example 4 — Windows Defender Antivirus Settings

📍 Navigation Path
Computer Configuration→Administrative Templates→Windows Components→Microsoft Defender Antivirus
✓ Action: Make sure 'Turn off Microsoft Defender Antivirus' is set to Disabled (i.e., Defender stays ON)
⚠ WarningCheck for 'Turn off Microsoft Defender Antivirus' — if this is set to 'Enabled', it DISABLES Defender entirely. This is a common competition vulnerability. Set it to 'Disabled' or 'Not Configured' to keep Defender active.

How GPO Settings Override Other Methods

★ FactGPO settings take precedence over Windows Settings, Control Panel, and even direct registry edits made by programs. If Windows Update appears stuck disabled even after you toggle it in Settings, the answer is always: check gpedit.msc. The policy is overriding your change.

Checking Effective Policy — gpresult

cmd
# Show all applied Group Policy settings for the computer
gpresult /r
 
# Generate a detailed HTML report — open in browser
gpresult /h C:\gpresult.html
 
# Force Group Policy to refresh immediately
gpupdate /force
🔒 SecurityRun gpresult /r early in a competition round to see which policies are applied. This reveals malicious or misconfigured GPO settings that override your manual fixes — you must change the GPO, not just the setting, or your fix won't stick.

Competition GPO Checklist

  • •Open gpedit.msc → scan Computer Configuration → Administrative Templates → Windows Components for disabled/misconfigured settings
  • •Windows Update: should be 'Not Configured' or 'Enabled' — never 'Disabled'
  • •Remote Desktop: 'Allow users to connect remotely' → should be Disabled unless scenario requires it
  • •AutoPlay: 'Turn off AutoPlay' → should be Enabled on All Drives
  • •Microsoft Defender Antivirus: 'Turn off Microsoft Defender Antivirus' → should be Disabled (so Defender stays ON)
  • •Run gpupdate /force after making any GPO changes to apply them immediately
🧠Quick Checkfirst try = +5 XP

A setting keeps reverting even after you change it in Windows Settings. Where should you look?

🎮 Practice what you learned
🏰
Password Fort
Build passwords that survive a brute-force siege
→🕵️
Log Analysis
Hunt attackers through real firewall & access logs
→
⭐ 0 XP🔥 0 days
Open the full interactive CyberPatriot Prep module →