GPO from forest root domain doesn't seem to be detected at child domains

[amferreira]

• PingCastle 3.2.0.1
• Running parameters: "--healthcheck --server domain.local,child.domain.local"
• Environment: AD forest "domain.local" + child domain "child.domain.local", running PingCastle from a server on "domain.local". Running user is a Group Managed Service Account from domain.local, has read permissions on all GPOs referenced here.

Example:

1. GPO created on domain.local to fix A-HardenedPaths
2. Linked GPO to OU "Domain Controllers" on domain.local and also on child.domain.local
3. Report from domain.local shows A-HardenedPaths has fixed
4. Report from child.domain.local still doesn't show this as fixed: "No GPO Found". (gpresult shows policies applied on all DCs on all domains)

Noticed the same behavior for "Audit settings" rules.

Creating the exact same GPO on child.domain.local and linking to the DCs child OU fixed the issue but forces to duplicate GPOs.

I'll be happy to provide additional details, if needed.

[rikardronnkvist]

Can confirm this, have the samme issue in a forrest.

[JoeDibley]

Thanks for the information. Confirmed this on my side too. I have added this to the backlog and hope it will be implemented in version 3.4.

The GPLink attributes are already checked so we need to implement some discovery mechanism for linked objects in other domains but also not scan the entire other domains Group Policy Objects to prevent different false positives/negatives.