Group Policy Preferences (GPP)

Pentesting in the Real World: Group Policy Pwnage | Rapid7 BlogRapid7

metasploit module = auxiliary smb_enum_gpp

HTB/Active(retired)

445 > open >

decrypt with hashcat -m 13100