Status
ISOLATED LAB
Phase
03_INITIAL_ACCESS
Egress
BLOCKED
?
Create Snapshot
Resume Session
APPRENTICESHIP // W3
GPO Strategy
Author, link, and audit Group Policy the way an enterprise would.
Set Current
Objectives
01
Build a baseline workstation GPO (screen lock, AppLocker in audit, PowerShell logging).
02
Enable Sysmon via GPO on WIN01 with a curated config.
03
Verify with gpresult and Event Viewer that policy applied cleanly.
Hosts in play
DC01.LAB
WIN01.LAB
Checklist
GPO 'CORP-WKS-Baseline' created and linked to OU=Workstations.
Sysmon service running on WIN01, events flowing to LINUX01.
PowerShell ScriptBlock logging enabled and verified in Event 4104.
Snapshot: gpo-baseline.