GPO stale-before-2020 count should be investigated
AD-GPO-03InfoActive DirectoryGroup Policy
Part of Active Directory · Active Directory · Group Policy · All checks
Invoke-Maester -TestId AD-GPO-03Overview
Section titled “Overview”Group Policy Objects (GPOs) that have not been modified for a long time can become “stale”. Stale GPOs may contain outdated security configurations, which can create security gaps if they no longer match your current security baselines.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Regularly review GPOs that have not changed recently. Consider:
- Validating that security settings are still required and aligned with your current baseline
- Removing or updating policies that are no longer used or no longer appropriate
- Establishing a review cadence for long-lived policies
How the Test Works
Section titled “How the Test Works”This test uses Get-MtADGpoState to retrieve cached GPO data.
It filters GPOs where ModificationTime is earlier than 2020-01-01 and calculates:
- Total number of GPOs
- Number and percentage of stale GPOs
Related Tests
Section titled “Related Tests”Test-MtAdGpoTotalCount- Counts the total number of GPOs
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-GPO-03 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Group Policy |
| Area | Infrastructure hardening |
| Resource type | GroupPolicy |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdGpoChangedBefore2020Count |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read |
Source
Section titled “Source”- Test:
tests/ad/gpo/Test.AD-GPO-03.ps1 - Documentation:
tests/ad/gpo/Test.AD-GPO-03.md