GPO blocked inheritance count should be compliant
AD-GPOL-05MediumActive DirectoryGroup Policy
Part of Active Directory · Active Directory · Group Policy · All checks
Invoke-Maester -TestId AD-GPOL-05Overview
Section titled “Overview”GPO inheritance blocking controls whether settings from parent Organizational Units (OUs) flow down to child OUs. When inheritance is blocked on an OU, policies from higher-level scopes won’t apply as expected.
For security assessments, this matters because inheritance blocking can create security gaps:
- Parent OU policies won’t apply to the affected OUs.
- Security baselines can become inconsistent across the directory.
- “Sticky” configurations at lower levels can persist unnoticed.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Review blocked inheritance regularly: confirm each OU blocking inheritance has a documented business/technical justification.
- Ensure compensating controls exist: if parent policies won’t apply, equivalent security settings must be configured directly where needed.
- Monitor and alert on changes: inheritance blocking is often changed unintentionally during OU restructuring or delegation work.
How the Test Works
Section titled “How the Test Works”This test retrieves Organizational Units (OUs) from Active Directory using:
Get-ADOrganizationalUnit -Filter * -Properties gpOptions- Counts OUs where
gpOptions -eq 1(wheregpOptionsindicates GPO inheritance blocking). - Reports the total OU count, the number of blocked OUs, and the blocked ratio in Markdown.
Related Tests
Section titled “Related Tests”Test-MtAdGpoEnforcedCount- Counts enforced (inheritance-blocking) link entriesTest-MtAdGpoLinkedCount- Counts GPOs actively linked to apply settingsTest-MtAdGpoUnlinkedCount- Identifies unlinked/orphaned GPOs
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-GPOL-05 |
| Severity | Medium |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Group Policy |
| Area | Infrastructure hardening |
| Resource type | OrganizationalUnit |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdGpoBlockedInheritanceCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read |
Source
Section titled “Source”- Test:
tests/ad/gpo/Test.AD-GPOL-05.ps1 - Documentation:
tests/ad/gpo/Test.AD-GPOL-05.md