Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A client on a company can run commands and view the Group Policy settings applied to his own account and computer.

The commands are:

  • gpresult (and all of its variants)
  • rsop.msc

In my opinion, telling a user what is being enforced upon him can have a minor flaw, as the security administrators will sometime prefer obscurity when it comes to internal users, not knowing what is their security level etc.

Is viewing applied group policy on a client PC not considered a minor security breach?

share|improve this question

In general, in a corporate environment, the rules under which staff should operate should be very transparent, as should the controls which enforce these rules.

Being able to view the group policy is rarely a security breach as it shouldn't be leaking information which is meant to stay hidden. The valuable part of the policy is the enforcement of permissions and access etc.

Security through obscurity is generally a bad thing in corporate environments (as well as many others) as it doesn't actually provide security against attackers or against accidental breaches.

share|improve this answer

Users not knowing their permissions is security-by-obscurity at best, and it may actually turn out to be a bigger security risk, bottom line. Users want to get things done, that's what they're paid for. If they can't, there are two possible scenarios:

a) Users run into obscure problems ("I saved a file there and there, and it just disappears"), they try to "solve" them on their own and become creative, possibly introducing all sorts of security and maintenance nightmares.

b) Users run into problems, but can find out that they lack permission to do what they want; typically, they will go see whoever is in charge of security and request that they be given suitable permissions, at which point it is possible to step in and either grant those permissions in a sane way, or show them the proper way to achieve their goals.

Also, if being able to view one's own effective permissions makes a system vulnerable, then the permissions are either flawed, or not properly enforced. After all, an attacker doesn't need to check permissions, (s)he can simply try to do what it is they want and see if it succeeds.

Viewing someone else's permissions is a different story though: it means that once you have broken into a non-privileged account, you can quickly find out which other accounts are most valuable for you (administrative permissions, access to interesting files, etc.) and then mount a targeted attack specifically for those users.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.