Windows AD GPO Deleted

This detection identifies when an Active Directory Group Policy is deleted using the Group Policy Management Console. Deleting Group Policy Objects (GPOs) can be a legitimate administrative action, but it can also be used by adversaries to remove security controls, disable logging, or clean up traces of their activity. Monitoring for GPO deletions is crucial for maintaining the integrity of an Active Directory environment.