GPOs without domain computers count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Group Policy · All checks

Run this check

Invoke-Maester -TestId AD-GPOREP-06

Overview

Control Type

Detective

Test-MtAdGpoNoDomainComputersCount

Counts GPO reports that do not include Domain Computers.

Why This Test Matters

• Detective control: identifies GPO reports missing Domain Computers which could impact scope or applicability.

Security Recommendation

• Verify whether Domain Computers should be included and adjust GpoReports as needed to reflect accurate targeting.

How the Test Works

• Reads GPO state, counts the GPO reports without an access-allowed entry for Domain Computers (HasDomainComputers is false), and reports counts and samples.
• The default GPO permissions have no Domain Computers entry, so the test only fails for GPOs that have no entry for Authenticated Users either: computer accounts may be unable to read those GPOs (MS16-072).
• A GPO whose permissions could not be read is reported as not evaluated instead of as a finding. The result is then Investigate, or Skipped when no GPO could be evaluated.

Related Tests

• Test-MtAdGpoNoDomainComputersCount.

Related links

• Microsoft Learn - Group Policy management
• ANSSI checkpoint: https://www.anssi.gouv.fr/

Details

Every attribute of this check

Field	Value
Test ID	AD-GPOREP-06
Severity	Low
Suite	Active Directory
Product	Active Directory
Feature	Group Policy
Area	Access control
Resource type	GroupPolicy
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	None
PowerShell test	Test-MtAdGpoNoDomainComputersCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read

Source

• Test: tests/ad/gpo-state/Test.AD-GPOREP-06.ps1
• Documentation: tests/ad/gpo-state/Test.AD-GPOREP-06.md