# SYSVOL and NETLOGON

SYSVOL is the domain-wide share in Active Directory to which all authenticated users have read access. SYSVOL contains logon scripts, group policy data, and other domain-wide data which needs to be available anywhere there is a Domain Controller (since SYSVOL is automatically synchronized and shared among all Domain Controllers).

{% hint style="info" %}
All domain Group Policies are stored here: \\\\\<DOMAIN>\SYSVOL\\\<DOMAIN>\Policies\\
{% endhint %}

**Credentials in SYSVOL/NETLOGON**

The issue is that frequently the password is stored in clear-text within the script (such as a vbs file) which is often in SYSVOL. and NETLOGON&#x20;

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FrtUoPy4mPqJIgglA3xtp%2Fimage.png?alt=media&#x26;token=7b57c5bb-53b4-4a92-b329-0c7c1ac868a7" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Login script can be abused to embed a reverse shell.  Check logon Script abuse section.&#x20;
{% endhint %}

**Group Policy Preferences**

Check out [GPP](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/active-directory/group-policy-abuse/gpp-group-policy-preference-credential-discovery) section.  Often you can check mannualy under SYSVO directory like active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/active-directory/init-cred-acess/sysvol-and-netlogon.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.