Skip to main content
Version: 3.0.0-preview

AD-GPOS-04 - Disabled GPO settings count should be investigated

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Test-MtAdGpoSettingsDisabledCount​

Counts GPOs where settings are disabled (AllDisabled, UserDisabled, or ComputerDisabled).

Why This Test Matters​

  • Detective control: checks how many GPOs have disabled settings (AllDisabled, UserDisabled, ComputerDisabled).

Control Type​

Operational

Security Recommendation​

  • Review disabled settings to confirm they are intentional and document exceptions if needed.

How the Test Works​

  • Counts GPOs whose GpoStatus maps to a disabled state and reports totals and ratios.
  • Test-MtAdGpoAllSettingsDisabledDetails and Test-MtAdGpoSettingsDisabledCount.

Test Metadata​

FieldValue
Test IDAD-GPOS-04
SeverityInfo
SuiteActive Directory
ProductActive Directory
FeatureGroup Policy
AreaInfrastructure hardening
Resource typeGroupPolicy
MITRE ATT&CKNone
PowerShell testTest-MtAdGpoSettingsDisabledCount
ServicesActiveDirectory

Source​