> ## Documentation Index
> Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# GPLink

> A linked GPO applies its settings to objects in the linked container.

<img noZoom src="https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-AND-community-edition-pill-tag.svg?fit=max&auto=format&n=tTIczgde9H07oLXf&q=85&s=ad49a576589f4d2a8081df77d07fdf56" alt="Applies to BloodHound Enterprise and CE" width="482" height="45" data-path="assets/enterprise-AND-community-edition-pill-tag.svg" />

The GPLink relationship connects a Group Policy Object ([GPO](/resources/nodes/gpo)) to an AD [Domain](/resources/nodes/domain), organizational unit ([OU](/resources/nodes/ou)), or [Site](/resources/nodes/site) it is linked to.

For a [Domain](/resources/nodes/domain) or [OU](/resources/nodes/ou), the [GPO](/resources/nodes/gpo)'s settings apply to users and computers in that scope, including nested OUs. For a [Site](/resources/nodes/site), they apply to the site's domain controllers and to computers whose IP addresses fall within one of the site's subnets. The default site also covers computers that do not map to another site. User-side settings affect users who sign in to those computers.

The Enforced property on the edge indicates whether the [GPO](/resources/nodes/gpo) link is enforced, meaning it still applies if an [OU](/resources/nodes/ou) has blocked GPO inheritance.

## Abuse Info

Control over the [GPO](/resources/nodes/gpo) can be abused to compromise the AD accounts the GPO applies to by modifying the GPO policy settings.

Refer to [A Red Teamer's Guide to GPOs and OUs](https://wald0.com/?p=179) for details about the abuse technique, and check out the following tools for practical exploitation:

* **Windows**: [SharpGPOAbuse](https://github.com/FSecureLABS/SharpGPOAbuse)
* **Linux**: [pyGPOAbuse](https://github.com/Hackndo/pyGPOAbuse)

## Opsec Considerations

There is no opsec information for this edge.

## Edge Schema

Source: [GPO](/resources/nodes/gpo)\
Destination: [Domain](/resources/nodes/domain), [OU](/resources/nodes/ou), [Site](/resources/nodes/site)<br />
Traversable: ✅

## References

* [A Red Teamer's Guide to GPOs and OUs](https://wald0.com/?p=179)
* [GitHub: SharpGPOAbuse](https://github.com/FSecureLABS/SharpGPOAbuse)
* [GitHub: pyGPOAbuse](https://github.com/Hackndo/pyGPOAbuse)