Searching every GPO by the path GPMC shows you (and the DLL hunt it took to get there)

Wed, 11 Nov 2026 09:00:00 -0700

Pretty much every hardening guide, CIS benchmark, vendor KB and pentest report tells you to change a GPO the same way:

Go to Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Kerberos Policy and set Maximum lifetime for service ticket to 600 minutes.

Cool. So I have 2,000 GPOs, which ones set that and what are they set to?

GPMC won’t tell you, you just click through GPOs one at a time until you find it or give up. Get-GPOReport -ReportType Xml does get you the data, but here’s what that exact setting looks like in the XML:

reverse-engineering on Carter Griffin

Searching every GPO by the path GPMC shows you (and the DLL hunt it took to get there)