GPO unlinked details should be compliant
Part of Active Directory · Active Directory · Group Policy · All checks
Invoke-Maester -TestId AD-GPO-05Overview
Section titled “Overview”Unlinked Group Policy Objects (GPOs) are policies that exist in Active Directory but are not linked to any site, domain, or organizational unit (OU). Even when unlinked, these GPOs still represent configuration artifacts that can create operational overhead and increase risk.
- Security risk: Unused policies may still contain insecure settings that could be re-enabled accidentally.
- Operational complexity: GPO sprawl makes it harder to reason about what policies actually apply.
- Maintenance hygiene: Tracking unlinked GPOs supports safe cleanup and ongoing policy governance.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Review the returned unlinked GPOs and consider removing those that are no longer needed.
This reduces the attack surface by removing unused policies that could be re-linked or misconfigured in the future.
How the Test Works
Section titled “How the Test Works”This test uses Get-MtADGpoState to retrieve cached GPO data ($gpoState.GPOs). It then identifies unlinked
GPOs and generates a markdown table containing:
- GPO DisplayName
- CreationTime
- ModificationTime
The table is intended to support quick review during GPO cleanup and maintenance activities.
Related Tests
Section titled “Related Tests”Test-MtAdGpoUnlinkedCount- Identifies how many GPOs are not linked to any locationTest-MtAdGpoLinkedCount- Counts GPOs that are actively linkedTest-MtAdGpoTotalCount- Counts the total number of GPOs in the domain
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-GPO-05 |
| Severity | Low |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Group Policy |
| Area | Infrastructure hardening |
| Resource type | GroupPolicy |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdGpoUnlinkedDetails |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read |
Source
Section titled “Source”- Test:
tests/ad/gpo/Test.AD-GPO-05.ps1 - Documentation:
tests/ad/gpo/Test.AD-GPO-05.md