Skip to main content
Version: 3.0.0-preview

AD-GPOREP-11 - GPO no-apply Group Policy ACE details should be investigated

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Test-MtAdGpoNoApplyGroupPolicyAceDetails​

Returns details of GPOs missing the "Apply Group Policy" ACE.

Why This Test Matters​

  • Detective control: lists GPOs missing the Apply Group Policy ACE, which governs how policy is applied.

Control Type​

Operational

Security Recommendation​

  • Ensure required ACE is present or document why it is absent.

How the Test Works​

  • Reads GPO state, filters for reports where HasApplyGroupPolicyAce is false, and outputs a Markdown table of findings.
  • Test-MtAdGpoNoApplyGroupPolicyAceCount.

Test Metadata​

FieldValue
Test IDAD-GPOREP-11
SeverityInfo
SuiteActive Directory
ProductActive Directory
FeatureGroup Policy
AreaAccess control
Resource typeGroupPolicy
MITRE ATT&CKNone
PowerShell testTest-MtAdGpoNoApplyGroupPolicyAceDetails
ServicesActiveDirectory

Source​