Enumerate following for the us.techcorp.local domain:
- Restricted Groups from GPO
- Membership of the restricted groups
- List all the OUs
- List all the computers in the Students OU.
- List the GPOs
- Enumerate GPO applied on the Students OU.
Use PowerView:
Get-DomainGPOLocalGroup
Get-DomainGroupMember us\machineadmins
Use PowerView:
Get-DomainOU | Select DistinguishedName
(Get-DomainOU -Identity 'OU=Students,DC=us,DC=techcorp,DC=local').distinguishedname | %{Get-DomainComputer -SearchBase $_} | Select dnshostname
Get-DomainGPO
First get the gplink attribute of the Student OU:
Get-DomainOU | Where-Object {$_.name -Like "*Student*"}
{FCE16496-C744-4E46-AC89-2D01D76EAD68}
Then list the GPO applied on the Students OU:
Get-DomainGPO -Identity '{FCE16496-C744-4E46-AC89-2D01D76EAD68}'
