One Day Sec

What are the four types of script execution events in a Group Policy Object (GPO) that can be used for remote execution in a domain?

In a GPO, scripts can be configured to run during Startup, Shutdown, Logon, and Logoff events. Startup and Shutdown scripts are configured under Computer Configuration → Windows Settings → Scripts, while Logon and Logoff scripts are under User Configuration → Windows Settings → Scripts. This allows attackers to execute arbitrary scripts on target machines when specific events occur, as detailed in the article on Domain Penetration - Remote Execution via Scripts in GPO.
GPOstartup scriptshutdown scriptlogon scriptlogoff scriptremote execution

Browse all Q&A →