Skip to main content
Version: 3.0.0-preview

AD-GPOREP-14 - GPO enforcement count should be investigated

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Test-MtAdGpoEnforcementCount​

Counts the number of GPOs that have enforced GPO links.

Why This Test Matters​

  • Detective control: counts GPOs with enforced links which indicates explicit policy delivery is configured.

Control Type​

Operational

Security Recommendation​

  • Ensure enforcement aligns with security policy; adjust as needed for least privilege and correct policy propagation.

How the Test Works​

  • Fetches GPO state, filters for HasEnforcement, and reports total GPOs, number with enforcement, and the ratio.
  • Test-MtAdGpoEnforcementCount.

Test Metadata​

FieldValue
Test IDAD-GPOREP-14
SeverityInfo
SuiteActive Directory
ProductActive Directory
FeatureGroup Policy
AreaInfrastructure hardening
Resource typeGroupPolicy
MITRE ATT&CKNone
PowerShell testTest-MtAdGpoEnforcementCount
ServicesActiveDirectory

Source​