AUTOMATED SOFTWARE DEPLOYMENT TOOLS IN WINDOWS INFRASTRUCTURE. SECURITY ISSUES

This article presents an in-depth security analysis of the built-in Group Policy Software Installation (GPSI) mechanism used for centralized software deployment in Windows Active Directory environments. The research focuses on the practical assessment of security risks associated with the substitution of MSI installation packages stored in network shares under misconfigured access permissions. An isolated laboratory environment was deployed to simulate a typical corporate domain network segment, comprising a Windows Server 2025 domain controller and two Windows 10 Pro client workstations. A series of attack scenarios was conducted, demonstrating that when NTFS permissions are incorrectly configured — specifically, when the Authenticated Users group is granted Modify rights — a low-privileged domain user can successfully replace a legitimate MSI package with a malicious one and trigger its installation on all domain workstations. It was established that, in the absence of activated digital signature verification policies, client systems perform no integrity or authenticity checks on packages prior to installation, and standard event logging does not capture file substitution events. A second experimental phase validated two countermeasures: restricting NTFS permissions to Read-only and enabling mandatory digital signature verification policies. Both measures effectively blocked the described attack vector. The findings indicate that the primary risk stems not from architectural flaws in the GPSI protocol itself, but from configuration errors and the non-utilization of available platform-level security controls. Practical recommendations are formulated covering strict access control, mandatory MSI package signing, and enhanced file auditing on critical network shares.