get_foreign_gpo_controllers
Identify security principals from one domain that can modify Group Policy Objects in another domain to detect lateral movement and privilege escalation risks in Active Directory environments.
Instructions
Retrieves foreign GPO controllers from a specific domain in the Bloodhound database.
"Foreign GPO Controllers" are defined as security principals (users, groups, or computers) from one domain that have the ability to modify or control Group Policy Objects (GPOs) in another domain within the same forest
These are potential targets for lateral movement and privilege escalation as well as cross domain compromise.
Args:
domain_id: The ID of the domain to query
limit: Maximum number of foreign GPO controllers to return (default: 100)
skip: Number of foreign GPO controllers to skip for pagination (default: 0)Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain_id | Yes | ||
| limit | No | ||
| skip | No |