Skip to main content
Version: 3.0.0-preview

AD-GPOREP-20 - No GPOs should contain a default password

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Test-MtAdGpoDefaultPasswordFoundDetails​

Returns details of GPOs that contain a default password.

Why This Test Matters​

  • Detective control: verifies whether any GPO reports contain a default password and highlights those findings for remediation.
  • In security terms, default passwords in GPOs are a common misconfiguration risk that attackers could exploit.

Control Type​

Detective

Security Recommendation​

  • Review GPOs listed in the report and replace default passwords with secure, unique credentials per policy. Remove any passwords that are no longer needed.

How the Test Works​

  • Invokes Get-MtADGpoState to fetch GPO state data, then filters GPO reports where DefaultPasswordFound is true.
  • Builds a Markdown table of GPO name and the DefaultPasswordFound flag, plus a summary line with counts.
  • Test-MtAdGpoDefaultPasswordFoundCount - Counts how many GPOs have a default password.

Test Metadata​

FieldValue
Test IDAD-GPOREP-20
SeverityHigh
SuiteActive Directory
ProductActive Directory
FeatureGroup Policy
AreaAuthentication
Resource typeGroupPolicy
User impactLow
Implementation costMedium
MITRE ATT&CKT1552.001 Credentials In Files, T1552.006 Group Policy Preferences
Supports controlsnist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28
PowerShell testTest-MtAdGpoDefaultPasswordFoundDetails
ServicesActiveDirectory

Source​