Skip to main content
Version: 2.2.1-preview

AD-GPOREP-12 - GPO disabled link count should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Disabled GPO links represent a potential security and operational concern in Active Directory environments:

  • Policy Gaps: Disabled links mean GPOs that are configured but not applied, potentially leaving systems without intended security controls
  • Configuration Drift: Disabled links may indicate temporary troubleshooting that was never reverted
  • Audit Challenges: Disabled links create confusion during security audits about which policies are actually enforced
  • Compliance Risks: Unintentionally disabled links can result in non-compliance with security baselines

Security Recommendation​

Regularly review disabled GPO links and either:

  • Re-enable links that were accidentally disabled
  • Remove links that are no longer needed
  • Document the justification for intentionally disabled links
  • Ensure critical security policies are not inadvertently disabled

How the Test Works​

This test retrieves GPO link information from Active Directory and counts:

  • Total number of GPO links
  • Number of enabled links (state 0)
  • Number of disabled links (state 1)
  • Number of enforced links (state 2)

The gPLink attribute is parsed to determine the state of each link.

  • Test-MtAdGpoEnforcedCount - Counts enforced GPO links
  • Test-MtAdGpoLinkedCount - Counts distinct GPOs with links
  • Test-MtAdGpoUnlinkedCount - Identifies GPOs with no links

Test Metadata​

FieldValue
Test IDAD-GPOREP-12
SeverityInfo
SuiteActive Directory
CategoryAD.GPOState
PowerShell testTest-MtAdGpoDisabledLinkCount
TagsAD, AD-GPOREP-12, AD.GPOState

Source​

  • Pester test: tests/ad/gpostate/Test-MtAdGpoDisabledLinkCount.Tests.ps1
  • PowerShell source: powershell/public/ad/gpo/Test-MtAdGpoDisabledLinkCount.ps1