Carter Griffin

Searching every GPO by the path GPMC shows you (and the DLL hunt it took to get there)

Wed, 11 Nov 2026 09:00:00 -0700

Pretty much every hardening guide, CIS benchmark, vendor KB and pentest report tells you to change a GPO the same way:

Go to Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Kerberos Policy and set Maximum lifetime for service ticket to 600 minutes.

Cool. So I have 2,000 GPOs, which ones set that and what are they set to?

GPMC won’t tell you, you just click through GPOs one at a time until you find it or give up. Get-GPOReport -ReportType Xml does get you the data, but here’s what that exact setting looks like in the XML:

Azure Devops + Internal Nuget server for powershell module publishing

Sun, 08 Feb 2026 20:26:33 -0700

Recently, I found myself needing to distribute code to any windows server host in our environment such that any relevant account local to any host would be able to reliably run my code. Before traversing the internet to figure out how to do this, I considered a couple of low hanging options -

Home the modules in some network-accessible file share
Just push the module out to each target host via work pipeline
- generic psremoting, ansible, etc
Push module to public psgallery (lol)
Home modules in fileshare and deploy to all targets via gpo

The first option, while valid, didn’t feel robust enough for our environment - versioning would be dependent on a local git repo at best, and I could not reliably pin old versions without duplicating repo version structure in persistent storage.

About

Mon, 01 Jan 0001 00:00:00 +0000

I’m Carter. I do identity engineering and platform engineering for infrastructure at scale, which these days means a lot of Kubernetes, Active Directory, domain administration and hardening. This is where I write up things that were annoying to figure out, so they’re less annoying for the next person.

Code lives on GitHub.