AD-GPO-IMMEDIATEPrivilege Escalation

GPO Immediate Scheduled Task

Add an immediate scheduled task XML to a linked GPO — fires on next Group Policy refresh on every targeted host.

§ Where this technique fits

AD-GPO-IMMEDIATE is catalogued under the Privilege Escalation tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

§ Dossiers chaining this technique

GPO write rights → Immediate scheduled task → SYSTEM on OU
GenericWrite on a linked GPO (or write rights to its SYSVOL folder) lets you drop a ScheduledTasks.xml that fires as SYSTEM on every machine in the OU at the next gpupdate.
step 3 / 5

§ What commonly comes next

01
Scheduled Task/Job
T1053 · Execution
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

GPO write rights → Immediate scheduled task → SYSTEM on OU

§ What commonly comes next