[Solved] GPOs from an E01?
I have an E01 from a Windows Server 2016 (1607) Build 14393. What is the easiest way for me to pull all GPOs from the image and produce a report?
If you can boot the image (using a tool such as "VFC" or similar), you can generate a GPO report using GPEDIT.MSC tool or the "Get-GPOReport" Powershell tool.
RegRipper has three plugins that apply to GPOs - gpohist.pl, pendinggpos.pl, and ryuk_gpo.pl.
No need to boot anything...extract the Registry hives, run the plugins.