[Bug][harness] Adding a GPP printer mapping with SID-targeting to a GPO blocked as production-wide push

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): general

Why this is a false positive

The block fires on a routine Group Policy Preferences printer-mapping change—adding a per-user targeted printer connection to an existing GPO and incrementing its version so it applies on next refresh, which is the documented and intended mechanism for deploying printers via AD. The "modifies shared resources / pushes to all domain clients" framing is inaccurate: item-level targeting on a single user's SID scopes the change to one account, and a GPO version bump is the standard, expected side effect of any GPP edit rather than a destructive or out-of-scope action. This is core, in-scope administrative work an operator explicitly requested, so flagging it as unsafe is a false positive.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code. Filing as a false positive. Recurred 1× across 1 session(s); first seen 2026-06-25T21:32:48.287Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

[Modify Shared Resources] The agent is writing a new Printers.xml into a production Active Directory GPO ({3b972c0e...}) and bumping the GPO version, which will push the change to all domain clients at next policy refresh

Environment: Claude Code, Linux. · Work domain: general

---
_{🔎 Filed automatically by ClAudit v2.0.32 — a FOSS tool for reporting false-positive Claude Code blocks.}