No GPOs should contain a default password
AD-GPOREP-20HighActive DirectoryGroup Policy
Part of Active Directory · Active Directory · Group Policy · All checks
Invoke-Maester -TestId AD-GPOREP-20Overview
Section titled “Overview”Test-MtAdGpoDefaultPasswordFoundDetails
Section titled “Test-MtAdGpoDefaultPasswordFoundDetails”Returns details of GPOs that contain a default password.
Why This Test Matters
Section titled “Why This Test Matters”- Detective control: verifies whether any GPO reports contain a default password and highlights those findings for remediation.
- In security terms, default passwords in GPOs are a common misconfiguration risk that attackers could exploit.
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Review GPOs listed in the report and replace default passwords with secure, unique credentials per policy. Remove any passwords that are no longer needed.
How the Test Works
Section titled “How the Test Works”- Invokes Get-MtADGpoState to fetch GPO state data, then filters GPO reports where DefaultPasswordFound is true.
- Builds a Markdown table of GPO name and the DefaultPasswordFound flag, plus a summary line with counts.
Related Tests
Section titled “Related Tests”Test-MtAdGpoDefaultPasswordFoundCount- Counts how many GPOs have a default password.
Related links
Section titled “Related links”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-GPOREP-20 |
| Severity | High |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Group Policy |
| Area | Authentication |
| Resource type | GroupPolicy |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1552.001 Credentials In Files, T1552.006 Group Policy Preferences |
| Supports controls | nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28 |
| PowerShell test | Test-MtAdGpoDefaultPasswordFoundDetails |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read |
Source
Section titled “Source”- Test:
tests/ad/gpo-state/Test.AD-GPOREP-20.ps1 - Documentation:
tests/ad/gpo-state/Test.AD-GPOREP-20.md