Skip to main content
Version: 2.3.0

Test-MtAdGpoBlockedInheritanceCount

SYNOPSIS​

Counts targets blocking GPO inheritance.

SYNTAX​

Test-MtAdGpoBlockedInheritanceCount [-ProgressAction <ActionPreference>] [<CommonParameters>]

DESCRIPTION​

This test retrieves Active Directory Organizational Units (OUs) and counts how many targets are configured to block Group Policy Object (GPO) inheritance.

Blocked inheritance is set on OUs via the gpOptions attribute. When gpOptions -eq 1, GPO inheritance is blocked for that OU.

Blocking inheritance can create security gaps because settings from parent OUs won't apply. Policies can become "sticky" at lower levels, so blocked inheritance should be monitored and justified.

EXAMPLES​

EXAMPLE 1​

Test-MtAdGpoBlockedInheritanceCount

Returns $true when no OUs are blocking GPO inheritance, $false when blocked inheritance is present. The test result includes the blocked OU count.

PARAMETERS​

-ProgressAction​

Determines how PowerShell responds to progress updates generated by a script, cmdlet, or provider, such as the progress bars generated by Write-Progress.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

System.Boolean​

NOTES​

https://maester.dev/docs/commands/Test-MtAdGpoBlockedInheritanceCount