> For the complete documentation index, see [llms.txt](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://iptracej.gitbook.io/windows-linux-and-active-directory-ctf-notes/active-directory/init-cred-acess/sysvol-and-netlogon.md).

# SYSVOL and NETLOGON

SYSVOL is the domain-wide share in Active Directory to which all authenticated users have read access. SYSVOL contains logon scripts, group policy data, and other domain-wide data which needs to be available anywhere there is a Domain Controller (since SYSVOL is automatically synchronized and shared among all Domain Controllers).

{% hint style="info" %}
All domain Group Policies are stored here: \\\\\<DOMAIN>\SYSVOL\\\<DOMAIN>\Policies\\
{% endhint %}

**Credentials in SYSVOL/NETLOGON**

The issue is that frequently the password is stored in clear-text within the script (such as a vbs file) which is often in SYSVOL. and NETLOGON&#x20;

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FrtUoPy4mPqJIgglA3xtp%2Fimage.png?alt=media&amp;token=7b57c5bb-53b4-4a92-b329-0c7c1ac868a7" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Login script can be abused to embed a reverse shell.  Check logon Script abuse section.&#x20;
{% endhint %}

**Group Policy Preferences**

Check out [GPP](/windows-linux-and-active-directory-ctf-notes/active-directory/group-policy-abuse/gpp-group-policy-preference-credential-discovery.md) section.  Often you can check mannualy under SYSVO directory like active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml