Mass endpoint reboot with Group Policy processed (Event ID 1502) time-bomb GPO d

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•7

Detects a significant number of endpoints processing Group Policy computer configurations within a short time window. This activity is indicative of a synchronized event, such as a domain-wide application of a newly modified or deployed Group Policy Object (GPO), which may follow a 'time-bomb' malicious GPO detonation or unauthorized policy change.