Active › Module 2 › Lesson 2
Users Groups GPO
Users, groups, and Group Policy name identity and configuration — read membership literacy on $LAB_AD; defenders audit privileged groups.
Visual · t25_users_groups_gpo
Users/groups/GPO literacy. $LAB_AD only. Original Cyberlium.
Opening
Groups carry access; GPOs carry settings — know both before naming Kerberos abuse.
Users authenticate; security groups aggregate access (Domain Admins, Server Operators, custom app groups). Group Policy Objects (GPOs) deploy settings to OUs — password policy, LAPS, restricted groups, audit policies. Cyberlium documents example users, groups, and GPO links on YOUR $LAB_AD — not membership exports from production. Next: Trusts Named.
1. Users and groups (named)
User objects hold sAMAccountName, UPN, group memberships. High-value groups: Domain Admins, Enterprise Admins, Schema Admins, Account Operators — defenders monitor changes.
On $LAB_AD, list three lab users and two groups with one-line role each — fictional or course-supplied, not scraped from live HR systems.
Command guide
Try these commands — Users and groups (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Users and groups — https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups (group scope literacy) GPO overview — https://learn.microsoft.com/en-us/windows-server/identity/group-policy/group-policy-overview (GPO literacy) CISA AD guidance — https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
cat > "$LAB_AD/notes/structure-users-gpo.txt" <<'EOF'
users: lab accounts in YOUR forest only
groups: Domain Users, Domain Admins — understand membership, never abuse strangers
GPO: policy objects — literacy for defender hardening
EOFCommand — copy this
grep -E 'users|groups|GPO' "$LAB_AD/notes/structure-users-gpo.txt" curl -sS https://learn.microsoft.com/en-us/windows-server/identity/group-policy/group-policy-overview | head -8
Primary tools to practice this lesson: curl, grep. Reference sites: Users and groups (https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups); GPO overview (https://learn.microsoft.com/en-us/windows-server/identity/group-policy/group-policy-overview); CISA AD guidance (https://www.cisa.gov/resources-tools/resources/active-directory-security-best-practices). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. GPO basics (named)
GPOs link to sites, domains, or OUs. They enforce password length, lockout, RDP restrictions, and security baselines. GPO misconfiguration can weaken auth — defenders review with GPO reporting tools in authorized scope.
Literacy: name what a GPO does (e.g., 'Workstation Baseline — disables LM hashes') without exporting stranger GPO XML.
3. Defender audit habits
Regular review of Domain Admins membership, service accounts in privileged groups, and GPO linking on Tier 0 OUs. BloodHound-style graphs later visualize paths — structure notes feed that literacy.
Ship: users/groups/GPO card — three objects, two groups, one GPO, each with one-line defender note. Next: Trusts Named.
4. What you ship: users/groups/GPO card for $LAB_AD
Three users, two groups, one GPO with defender notes. $LAB_AD named. NO production exports. chmod 600.
5. What you record before the next lesson
Date. Users/groups/GPO card. $LAB_AD named. File t25-m02-l02-users-groups-gpo.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Export Domain Admins from employer AD. Share real employee sAMAccountNames in chat.
Right
Write users/groups/GPO card from YOUR $LAB_AD documentation. Next: Trusts Named.
Mission: document identity objects on YOUR lab
1) List three lab users and two groups. 2) Name one GPO and its purpose. 3) Note one privileged group to monitor. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Domain Admins membership changes deserve alerts in real tenants.
Knowledge Check
APPLY: Users/groups/GPO literacy helps by:
Multiple choice
Knowledge Check
APPLY: True or False: Domain Admins is a high-value group defenders monitor.
True or False
Knowledge Check
APPLY: GPO primarily deploys:
Multiple choice