Enforced GPO link count should be retrievable
AD-GPOL-04InfoActive DirectoryGroup Policy
Part of Active Directory · Active Directory · Group Policy · All checks
Invoke-Maester -TestId AD-GPOL-04Overview
Section titled “Overview”Enforced Group Policy Object (GPO) links are special link entries that block inheritance from being overridden at lower levels (for example, by child OUs).
This can be a powerful mechanism for security baselines, but it also increases the chance that a critical policy unintentionally becomes “sticky” across the domain.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Enforced GPOs override inheritance blocking: any configuration enforced at a higher scope can still apply even if child OUs attempt to disable inheritance.
- Use enforced links sparingly: reserve them for critical security policies that must apply everywhere.
- Review enforced policies regularly: confirm the GPO’s purpose and ownership, and ensure the enforced settings remain aligned with current security requirements.
How the Test Works
Section titled “How the Test Works”This test retrieves Active Directory GPO state from Get-MtADGpoState (using $gpoState.GPOLinks) and:
- Examines each collected link object for the
Enforcedproperty. - Counts link entries where
Enforcedis$true. - Reports the enforced link count and the enforced ratio in Markdown.
Related Tests
Section titled “Related Tests”Test-MtAdGpoTotalCount- Counts total GPO inventoryTest-MtAdGpoLinkedCount- Identifies GPOs that are actively linkedTest-MtAdGpoUnlinkedCount- Identifies GPOs not linked anywhereTest-MtAdGpoUnlinkedDetails- Shows unlinked GPO details
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-GPOL-04 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Group Policy |
| Area | Infrastructure hardening |
| Resource type | GroupPolicy |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdGpoEnforcedCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read |
Source
Section titled “Source”- Test:
tests/ad/gpo/Test.AD-GPOL-04.ps1 - Documentation:
tests/ad/gpo/Test.AD-GPOL-04.md