As no one knew a working example, I had to weaponize GPO Extensions on my own 😎
The practice is a bit harder than just dropping a DLL and new key in Winlogon\GPExtensions. I believe there is a simpler way, but this one works. Unfortunately it requires AD connectivity.
A 🧵⤵ 1. Create the DLL exporting PFNPROCESSGROUPPOLICY callback function, as defined at
2. "return 0" is enough for the code.
3. The real code can be put into DllMain(), of course it works.
4. Make a key in Windows NT\CurrentVersion\Winlogon\GPExtensions.learn.microsoft.com/en-us/windows/…