Notifications
Clear all

[Solved] GPOs from an E01?  

  RSS
castle228
(@castle228)
New Member

I have an E01 from a Windows Server 2016 (1607) Build 14393. What is the easiest way for me to pull all GPOs from the image and produce a report? 

TIA

Quote
Posted : 07/10/2020 9:20 pm
JimC
 JimC
(@jimc)
Member

If you can boot the image (using a tool such as "VFC" or similar), you can generate a GPO report using GPEDIT.MSC tool or the "Get-GPOReport" Powershell tool.

 

Jim

www.binarymarup.com

ReplyQuote
Posted : 19/10/2020 12:21 pm
keydet89
(@keydet89)
Community Legend

RegRipper has three plugins that apply to GPOs - gpohist.pl, pendinggpos.pl, and ryuk_gpo.pl.  

No need to boot anything...extract the Registry hives, run the plugins.

ReplyQuote
Posted : 20/10/2020 12:45 pm
Share: