Disabled GPO link count should be retrievable
AD-GPOL-02InfoActive DirectoryGroup Policy
Part of Active Directory · Active Directory · Group Policy · All checks
Invoke-Maester -TestId AD-GPOL-02Overview
Section titled “Overview”Disabled GPO links represent a potential security and operational concern in Active Directory environments:
- Policy Gaps: Disabled links mean GPOs that are configured but not applied, potentially leaving systems without intended security controls
- Configuration Drift: Disabled links may indicate temporary troubleshooting that was never reverted
- Audit Challenges: Disabled links create confusion during security audits about which policies are actually enforced
- Compliance Risks: Unintentionally disabled links can result in non-compliance with security baselines
Security Recommendation
Section titled “Security Recommendation”Regularly review disabled GPO links and either:
- Re-enable links that were accidentally disabled
- Remove links that are no longer needed
- Document the justification for intentionally disabled links
- Ensure critical security policies are not inadvertently disabled
How the Test Works
Section titled “How the Test Works”This test retrieves GPO link information from Active Directory and counts:
- Total number of GPO links
- Number of enabled links (state 0)
- Number of disabled links (state 1)
- Number of enforced links (state 2)
The gPLink attribute is parsed to determine the state of each link.
Related Tests
Section titled “Related Tests”Test-MtAdGpoEnforcedCount- Counts enforced GPO linksTest-MtAdGpoLinkedCount- Counts distinct GPOs with linksTest-MtAdGpoUnlinkedCount- Identifies GPOs with no links
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-GPOL-02 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Group Policy |
| Area | Infrastructure hardening |
| Resource type | GroupPolicy |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtCheckADGPOL02 |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read |
Source
Section titled “Source”- Test:
tests/ad/gpo/Test.AD-GPOL-02.ps1 - Documentation:
tests/ad/gpo/Test.AD-GPOL-02.md