SharpGPOAbuse abuses edit rights over a Group Policy Object to push malicious settings to every computer/user in the GPO's scope. --AddLocalAdmin injects a Restricted Groups / GptTmpl.inf entry that adds the specified account to the local Administrators group on all machines the GPO applies to. You must already have write access to the target GPO (found via PowerView's Get-DomainGPO ACLs); changes take effect at the next Group Policy refresh, so consider forcing gpupdate on target hosts.
Command Reference:
Username: john
Target GPO: Vulnerable GPO
SharpGPOAbuse --AddUserRights assigns Windows privileges / logon rights to an account through an editable GPO, writing them into the GPO's security template. Granting rights such as SeDebugPrivilege, SeTakeOwnershipPrivilege, or SeRemoteInteractiveLogonRight to a controlled user provides a durable escalation and remote-logon foothold across every host in scope. The --UserRights list is comma-separated and case-sensitive and must use the exact NT privilege constant names.
Command Reference:
Username: john
Target GPO: Vulnerable GPO