GPO total count should be retrievable
AD-GPO-01InfoActive DirectoryGroup Policy
Part of Active Directory · Active Directory · Group Policy · All checks
Invoke-Maester -TestId AD-GPO-01Overview
Section titled “Overview”Understanding the total number of Group Policy Objects (GPOs) in your Active Directory environment is crucial for several security and operational reasons:
- Policy Sprawl: A large number of GPOs can indicate policy sprawl, making it difficult to manage and troubleshoot policy conflicts
- Performance Impact: Each GPO adds processing overhead during user logon and computer startup
- Security Complexity: More GPOs mean more potential attack surfaces if any contain misconfigurations
- Audit Requirements: Compliance frameworks often require understanding of policy scope and distribution
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Regularly audit your GPO inventory and consolidate redundant or overlapping policies. Consider:
- Merging GPOs with similar settings
- Removing unused or obsolete GPOs
- Documenting the purpose of each GPO
- Implementing a naming convention for better organization
How the Test Works
Section titled “How the Test Works”This test retrieves all Group Policy Objects from Active Directory and counts the total number. It uses the Get-MtADGpoState function to access cached GPO data.
Related Tests
Section titled “Related Tests”Test-MtAdGpoUnlinkedCount- Identifies GPOs that are not linked to any locationTest-MtAdGpoCreatedBefore2020Count- Identifies potentially outdated GPOsTest-MtAdGpoLinkedCount- Counts GPOs that are actively linked
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-GPO-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Group Policy |
| Area | Infrastructure hardening |
| Resource type | GroupPolicy |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdGpoTotalCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read |
Source
Section titled “Source”- Test:
tests/ad/gpo/Test.AD-GPO-01.ps1 - Documentation:
tests/ad/gpo/Test.AD-GPO-01.md