Group Policy Preferences (GPP)

https://blog.rapid7.com/2016/07/27/pentesting-in-the-real-world-group-policy-pwnage/blog.rapid7.com

metasploit module = auxiliary smb_enum_gpp

HTB/Active(retired)

445 > open >

decrypt with hashcat -m 13100