Skip to main content
Version: 3.0.0-preview

AD-GPOREP-07 - GPOs with deny ACE count should be retrievable

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Control Type​

Detective

Test-MtAdGpoDenyAceCount​

Counts GPO reports that include a Deny ACE.

Why This Test Matters​

  • Detective control: checks for Deny ACEs in GPO reports which can override permissions.

Security Recommendation​

  • Review or remove Deny ACEs to ensure proper permission handling.

How the Test Works​

  • Aggregates GPO reports, counts those with HasDenyAce true, and reports totals and a sample of affected GPOs.
  • Test-MtAdGpoDenyAceDetails.

Test Metadata​

FieldValue
Test IDAD-GPOREP-07
SeverityMedium
SuiteActive Directory
ProductActive Directory
FeatureGroup Policy
AreaAccess control
Resource typeGroupPolicy
User impactLow
Implementation costMedium
MITRE ATT&CKNone
PowerShell testTest-MtAdGpoDenyAceCount
ServicesActiveDirectory

Source​