Access to Group Policy Preferences Groups.xml File

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•3

Detects read access to the Groups.xml file located in the SYSVOL share. This file is often used by Group Policy Preferences (GPP) to store credentials for local administrator accounts, which can be retrieved and decrypted by unauthorized users.