gppass

What it does

Decrypts the cpassword value which can be found in some GPO files. Just a helper utility really.

Remarks

Found it useful on some security assessments.

Requirements

You will have to find the encrypted password first. These can be located on the domain controller file share (accessible by everyone) or cached on a domain-joined machine.

Subcommands

None

Switches

None

Examples

• pypykatz gppass <base64_enc_password>: Decrypts the <base64_enc_password>