GPO

A GPO is a bundle of configuration settings in Active Directory that administrators apply to users and computers across a domain, controlling everything from password rules to firewall settings. GPOs are a primary tool for hardening Windows fleets at scale. They are also a prime target: an attacker who gains rights to edit a GPO can push malicious scripts or ransomware to every machine it covers, so GPO permissions deserve careful auditing.