New Query - All GPOs applied to a specific computer.yml

[auk0x01]

We made a query to find all GPOs that are applied to any specific computer. Helpful in large AD environments where GPO inheritance is complex :)

[martinsohn]

Thanks for the commit @auk0x01, I made slight modifications to the commit.

• Replace 'Base' with ':Base'
• Reverse path and return p
• Add accuracy disclaimer

There is a way of taking 'Overriding and Blocking Group Policy' into account, but awaiting BloodHound's Postgres db support for HEAD() and TAIL()

// GPOs affecting specified target
MATCH p=(:GPO)-[r:GPLink|Contains*1..]->(:Base{objectid:'<oid>'})
WHERE HEAD(r).enforced OR NONE(n in TAIL(TAIL(NODES(p))) WHERE (n:OU AND n.blocksinheritance))
RETURN p

[auk0x01]

Hey @martinsohn thanks for the modifications.

I think you replaced 'Base' with ':OU', not with ':Base'. This way, the query will only find OU-level GPOs and not Domain-level GPOs. In the case of Domain-level GPOs, the GPOs have a 'GPLink' to the Domain instead of an OU. That's why we used the Base node so that the GPO can have a GPLink to either the Domain or an OU.

Another thing: we used the 'toLower()' function to make this query case-insensitive so that users can have an easier time entering the computer name even in different casing styles.

[martinsohn]

Makes sense @auk0x01, I will get it fixed! Thank you.

Btw, we got a GitHub Actions issue, we're working on addressing that.

[auk0x01]

@martinsohn Oh ok, thanks a lot. I will be waiting for you guys to resolve the issue then.
By the way, any approximate time for the fix ? XD