gpo-enum v1.7.0
Full GptTmpl.inf [Registry Values] coverage
Previously the parser only caught settings in [System Access] and [Privilege Rights]. The [Registry Values] section was silently skipped, missing UAC config, NTLM settings, and more.
Now surfaces all security-relevant registry values pushed via GptTmpl.inf:
| Setting | What it means |
|---|---|
| EnableLUA=0 | UAC fully disabled → HIGH |
| FilterAdministratorToken=0 | Built-in admin unfiltered → HIGH |
| ConsentPromptBehaviorAdmin | All 6 values decoded → HIGH/MEDIUM/INFO |
| PromptOnSecureDesktop=0 | UAC prompt spoofable → MEDIUM |
| EnableSecureUiaPaths=0 | UIA runs elevated without isolation → MEDIUM |
| LocalAccountTokenFilterPolicy=1 | Remote PtH viable → HIGH |
| LmCompatibilityLevel < 3 | NTLMv1 allowed → HIGH |
| UseLogonCredential=1 (WDigest) | Cleartext creds → CRITICAL |
| NoLMHash=0 | LM hashes stored → HIGH |
| RequireSecuritySignature=0 | SMB relay viable → HIGH |
| AlwaysInstallElevated=1 | MSI privesc → CRITICAL |