GPO Execution Sanity

CSEs are components that generally will be executed with very high privileges on a domain machine during the GPO application. Hence, it is essential to ensure that every Client-Side Extension (CSE) contained in a GPO is sane and has been certified by a trusted party.

It is also crucial that all GPO files retrieved by domain computers originate from a safe place, before anything is applied.

You should remove unknown CSEs that are considered dangerous or add them to the whitelist if you accept the risk. The GpcFileSysPath attribute should point towards a safe location such as the SYSVOL share share.

Name: GPO Execution Sanity

Codename: C-GPO-EXEC-SANITY

Severity: High