gpo-enum v1.10.1

Fixes

• Consistent UTC timestamps. Log lines now use the shared YYYY-MM-DD HH:MM:SS UTC -- format (matching spectral/gh-enum/aws-enum) instead of a bare HH:MM:SS. The output-directory stamp is now UTC too, so the folder name lines up with the UTC times in the report (it previously used local time).

gpo-enum v1.10.0

Fixes

• Flags now work in any position. Go's flag parser stopped at the first positional arg, so gpo-enum ... <DC> -proxy URL silently dropped -proxy (and any flag after the DC), causing SMB to dial direct. Args are now permuted so flags are honored before or after the positional DC.
• -policy <GUID> no longer enumerates the whole domain. A bare-GUID -policy now does a targeted LDAP lookup for just that GPO (indexed cn= / gPLink substring) and accesses \Policies\{GUID} directly, instead of resolving every GPO name + link and listing every SYSVOL folder first. Big win over high-latency proxy pivots. Display-name / partial -policy still uses the full resolve+filter path.

Verified against the Ludus lab (both GUID and name -policy paths).

gpo-enum v1.9.0

LDAPS support

• LDAPS (port 636) is now the primary LDAP transport — fixes 'Strong Auth Required' on DCs with LDAP signing enforced
• Falls back to plain LDAP (389) automatically if 636 is unavailable

Binaries

• gpo-enum-linux-amd64 — Linux x86-64
• gpo-enum.exe — Windows x86-64

gpo-enum v1.8.0

v1.8.0

• Timestamps on all log lines (HH:MM:SS UTC)
• Auto-collect: raw SYSVOL files saved to outDir/sysvol/ mirroring the full path structure
• Proxy fixed: -proxy now actually works (was silently ignored before)
• -H accepts :hash or bare hash — no more full LM:NT required
• [Registry Values] section in GptTmpl.inf fully parsed (UAC, NTLM, SMB signing, etc.)
• Services.xml, Printers.xml, DataSources.xml parsers added
• LAPS disabled detection bug fixed
• Output style aligned with spectral/gh-enum (bold white labels, Auth field)

gpo-enum v1.7.0

Full GptTmpl.inf [Registry Values] coverage

Previously the parser only caught settings in [System Access] and [Privilege Rights]. The [Registry Values] section was silently skipped, missing UAC config, NTLM settings, and more.

Now surfaces all security-relevant registry values pushed via GptTmpl.inf:

Setting	What it means
EnableLUA=0	UAC fully disabled → HIGH
FilterAdministratorToken=0	Built-in admin unfiltered → HIGH
ConsentPromptBehaviorAdmin	All 6 values decoded → HIGH/MEDIUM/INFO
PromptOnSecureDesktop=0	UAC prompt spoofable → MEDIUM
EnableSecureUiaPaths=0	UIA runs elevated without isolation → MEDIUM
LocalAccountTokenFilterPolicy=1	Remote PtH viable → HIGH
LmCompatibilityLevel < 3	NTLMv1 allowed → HIGH
UseLogonCredential=1 (WDigest)	Cleartext creds → CRITICAL
NoLMHash=0	LM hashes stored → HIGH
RequireSecuritySignature=0	SMB relay viable → HIGH
AlwaysInstallElevated=1	MSI privesc → CRITICAL

gpo-enum v1.6.0

-H now accepts :hash or bare hash

No more typing the full LM:NT. All three formats work:

-H :8846f7eaee8fb117ad06bdd830b7586c
-H 8846f7eaee8fb117ad06bdd830b7586c
-H aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c

gpo-enum v1.5.0

Bug fix: proxy was silently ignored

The -proxy flag was parsed but never wired into the transport layer — every run went direct regardless. Fixed by calling transport.Configure() at startup.

Also auto-normalizes socks5:// → socks5h:// so hostname resolution always happens inside the proxy. No more DNS leakage from the operator host. Just use -proxy socks5://... and it does the right thing.

Verified

• Password auth ✓
• NTLM hash auth (-H LM:NT) ✓
• Proxy auto-upgrade ✓

Binaries

• gpo-enum-linux-amd64 — Linux x86-64 static binary
• gpo-enum.exe — Windows x86-64 static binary

gpo-enum v1.4.0

What's New

New GPP parsers:

• Services.xml — service account cpassword (MS14-025) + domain service account detection
• Printers.xml — SharedPrinter and PortPrinter cpassword
• DataSources.xml — ODBC data source cpassword and username leakage

Bug fix:

• LAPS disabled state was never detected: admPwdEnabled was looked up against a lowercased map so the check always missed — fixed to use admpwdenabled

Binaries

• gpo-enum-linux-amd64 — Linux x86-64 static binary
• gpo-enum.exe — Windows x86-64 static binary

sysvol-enum v1.3.0

Add Registry.xml (GPP) parser

Thorough coverage of Group Policy Preferences registry entries across all severity levels:

CRITICAL: credential-named value names, AutoAdminLogon, DefaultPassword, WDigest UseLogonCredential=1, AlwaysInstallElevated
HIGH: LSA protection off, NTLMv1, LM hashes, RestrictedAdmin disabled, UAC off/suppressed, LocalAccountTokenFilterPolicy=1, Defender disabled (5 settings), WinRM cleartext/Basic auth, SMB signing not required, firewall off, null session access, RDP saved passwords
MEDIUM: RDP enabled, PowerShell Bypass/Unrestricted, SMB signing disabled, RDP password saving
INFO: Run key entries, credential cache count, PowerShell RemoteSigned

sysvol-enum v1.2.0

Rename to sysvol-enum + output directory auto-save

• Renamed tool from sysvol-gpo-enum to sysvol-enum
• Auto-saves timestamped output directory on every run (no flag needed)
  • report.txt — full console output
  • report.json — structured findings
  • summary.txt — findings only, grouped by severity
• Output style aligned with spectral/aws-enum toolset (limeGreen+purple, header/section pattern)
• Engagement context block: Target / Domain / User / Output / Started
• -policy flag to target a single GPO by name or GUID