GPO created before 2020 count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Group Policy · All checks

Run this check

Invoke-Maester -TestId AD-GPO-02

Overview

Group Policy Objects (GPOs) created a long time ago can be a sign of policy growth over time. Older GPOs may contain outdated security settings, legacy configuration patterns, and assumptions that no longer match your current security baseline.

Tracking the count of GPOs created before 2020 helps you quickly identify areas that may benefit from review and modernization.

Control Type

Detective

Security Recommendation

• Review legacy GPOs regularly: Older GPOs are more likely to include security configurations that are no longer aligned to current best practices.
• Validate intended changes: Before updating or removing an older GPO, validate its purpose, inheritance, and scope to avoid unintended access or availability impacts.
• Plan for modernization: Consolidate redundant GPOs and update policy settings to match current compliance and security requirements.

How the Test Works

This test retrieves GPO state from Active Directory using Get-MtADGpoState (it uses $gpoState.GPOs).

It then filters all GPOs where the CreationTime is earlier than January 1st, 2020 and reports the resulting count.

Related Tests

• Test-MtAdGpoTotalCount - Total GPO inventory
• Test-MtAdGpoUnlinkedCount - GPOs not linked anywhere
• Test-MtAdGpoLinkedCount - GPOs that are actively linked

Details

Every attribute of this check

Field	Value
Test ID	AD-GPO-02
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Group Policy
Area	Infrastructure hardening
Resource type	GroupPolicy
MITRE ATT&CK	None
PowerShell test	Test-MtAdGpoCreatedBefore2020Count
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read

Source

• Test: tests/ad/gpo/Test.AD-GPO-02.ps1
• Documentation: tests/ad/gpo/Test.AD-GPO-02.md