📜 Honey GPO

A decoy Group Policy object, and a SYSVOL preference file, that nothing legitimate ever reads.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

Create a Group Policy object linked to an empty OU, and place a Group Policy Preferences file in its SYSVOL folder holding a decoy cpassword. No computer or user is in scope, so nothing legitimate reads either. GPO enumeration (Get-DomainGPO, BloodHound) reads the decoy GPO object, and GPP password harvesting (Get-GPPPassword) reads the decoy file. Both reads are audited.

Implementation requirements

A GPO linked to an empty or isolated OU, named in the estate's own GPO naming convention
Audit Directory Service Access enabled, with a SACL on the decoy groupPolicyContainer object so reads raise event 4662
A Groups.xml preference file in the decoy GPO's SYSVOL folder holding a decoy cpassword for a disabled, privilege-free account; audit access to it (event 4663), or deny Everyone and audit the failures, as Metcalf (2015) suggests
Alert on any 4662 or 4663 against the decoy objects, and on any logon attempt with the decoy account
Safety: the decoy account is disabled and holds no rights; the GPO applies to no real machine
Rollback: Unlink and delete the GPO and its SYSVOL files, then disable the decoy account.
Upkeep: Check after domain changes that the OU stays empty and the SACL remains. Quarterly proof-of-life read.

Cost

Negligible. A GPO and a SYSVOL file are free; audit volume is low because nothing legitimate touches them.

Indicative only. Cloud pricing and licensing change — check the provider's official pricing pages for current rates before you budget.

Technologies

Windows

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1552.006 Group Policy Preferences	Credential Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Finding Passwords in SYSVOL & Exploiting Group Policy Preferences — Recommends placing a decoy GPP XML file in SYSVOL and auditing access to it: with no GPO behind it, there is no legitimate reason to read it. 4663(S) An attempt was made to access an object — Event 4663 records reads of a file that carries an audit SACL. MITRE ATT&CK Enterprise v20.0 — Procedure examples: Wizard Spider uses Get-GPPPassword and Find-GPOPassword; APT33 uses Gpppassword.
T1615 Group Policy Discovery	Discovery	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) 4662(S, F) An operation was performed on an object — Event 4662 records operations on an Active Directory object that carries a SACL, including objects of class groupPolicyContainer. Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Rates T1615 as highly feasible with a honey GPO: enumeration tools read every GPO in the domain. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1615 Group Policy Discovery as an adversary behaviour. Moderate: the behaviour and the audit signal are documented; no study or product shows a decoy GPO caught this way.

Evidence

Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros, V.; Catania, C.; Lisý, V.; Griffioen, H., Stratosphere Laboratory, Czech Technical University in Prague 2026 preprint
Finding Passwords in SYSVOL & Exploiting Group Policy Preferences — Metcalf, S., ADSecurity.org 2015 practitioner
4662(S, F) An operation was performed on an object — Microsoft industry
4663(S) An attempt was made to access an object — Microsoft industry
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: Metcalf (ADSecurity.org, 2015) recommends a decoy GPP XML file in SYSVOL with access auditing, since no legitimate GPO references it. GPP password harvesting is documented attacker tradecraft (ATT&CK T1552.006: Wizard Spider, APT33). Valeros et al. (2026) rate T1615 Group Policy Discovery as highly feasible with a honey GPO.