How do I tell what changes did the group policy made?

Tim

8/22/24, 3:33 PM

I have a situation where someone within a client's SecOps team made a GPO change but is not fessing up to it because it caused a pretty big outage.

From the Windows Event Logs on the affected server, I can see logs saying before and after the incident:

The Group Policy settings for the computer were processed successfully. New settings from 4 Group Policy objects were detected and applied.

Assuming the person made the change, then after we reported the outage undid those changes, is there a way for us to determine precisely what changes were made by the GPO policy being applied?

There are a few parties involved in the incident, including two third-party MSPs. Everyone (including the customer's new Sec Analyst) is trying to take advantage of the situation, throw their hands up, and say "There were no changes". We're the ones left on the hook because it impacted a service running on the server that we manage for the customer. As such, if you have any ideas on how we can determine what was changed, that would be much appreciated.

1 + 2

windows

group-policy

Zac67

8/22/24, 6:22 PM

Try running `rsop.msc`.

Jan

8/23/24, 6:21 AM

do you know which GPO the change was made in? You could just show them that the version number increased from day X to day Y to shut them up

Score:1

Server

yagmoth555

8/22/24, 7:06 PM

It depend, if lucky the bad settings got caught inside a shadow copy snapshot.

As on the DC you could see the change inside the SYSVOL's volume policies's folder. On the GPO itself it will list the last time it was changed, but more importantly if you have shadowcopy you might be able to see the before / after.

gpt.ini list the version, and in the folder you can check the policy's file with a text editor. Some settings are hard to read, but it will give an idea.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How do I tell what changes did the group policy made?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.