PowerView Get-DomainGPO

Get-DomainGPO | select displayname,name,gpcfilesyspath

Enumerate domain GPOs (Group Policies), including file storage paths.

To find GPOs containing local admin passwords (SYSVOL), startup scripts, or software deployment policies that may hold credentials. It is one of the most common paths for privilege escalation in AD.

If you lack access to SYSVOL or if GPOs are not relevant for escalation (e.g., only remote desktop policies).