gpfixup /oldname /newname "That," Alex said, "rewrites domain references in SYSVOL. Use it wrong, and no computer will know which domain to trust."

secedit /export /cfg C:\policy.inf He edited the .inf file to harden the macro settings, then pushed it back with:

But his real challenge was the finance department. They were remote, not on the VPN. How do you update Group Policy for a laptop that can't see the Domain Controller?

He pulled up the heavy artillery: (Local Group Policy Object Utility). This wasn't a native Windows command; it was a tool from Microsoft’s Security Compliance Toolkit. Alex copied it to his network share.

gpresult /r This was his X-ray vision. The command showed him exactly which policies were applied and, crucially, which were filtered out . He saw that the "Block Macros" policy was being overridden by a local administrator's preference.

Then he remembered a rumor he’d dismissed as hacker folklore: You can control Group Policy entirely from the command line.