GITBOOK-686: No subject

HackTricks-wiki · Oct 2, 2024 · ba205c9 · ba205c9
1 parent 566570d
commit ba205c9
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/pentesting-cloud/gcp-security/gcp-persistence/gcp-non-svc-persistance.md b/pentesting-cloud/gcp-security/gcp-persistence/gcp-non-svc-persistance.md
@@ -157,6 +157,8 @@ Actually in **`HKLM:\SOFTWARE\Google\GCPW\Users`** it's possible to find the **d
 
 And in **`HKCU:\SOFTWARE\Google\Accounts`** it's possible to access the email of the user and the encrypted **refresh token** if the user recently logged in.
 
+Moreover, the file `C:\ProgramData\Google\Credential Provider\Policies\<sid>\PolicyFetchResponse` is a json containing the information of different **settings** like `enableDmEnrollment`, `enableGcpAutoUpdate`, `enableMultiUserLogin` (if several users from Workspace can login in the computer) and `validityPeriodDays` (number of days a user doesn't need to reauthenticate with Google directly).
+
 ### GCPW - Registry Refresh Tokens
 
 Inside the registry **`HKCU:\SOFTWARE\Google\Accounts`** it might be possible to find some accounts with the **`refresh_token`** encrypted inside. The method **`ProtectedData.Unprotect`** can easily decrypt it.