# GPO created before 2020 count should be retrievable

Group Policy Objects (GPOs) created a long time ago can be a sign of policy growth over time.

Source: https://maester.dev/docs/tests/AD-GPO-02

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Group Policy · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-GPO-02
```

## Overview

Group Policy Objects (GPOs) created a long time ago can be a sign of policy growth over time. Older GPOs may contain outdated security settings, legacy configuration patterns, and assumptions that no longer match your current security baseline.

Tracking the count of GPOs created before 2020 helps you quickly identify areas that may benefit from review and modernization.

#### Control Type

**Detective**

#### Security Recommendation

- **Review legacy GPOs regularly**: Older GPOs are more likely to include security configurations that are no longer aligned to current best practices.
- **Validate intended changes**: Before updating or removing an older GPO, validate its purpose, inheritance, and scope to avoid unintended access or availability impacts.
- **Plan for modernization**: Consolidate redundant GPOs and update policy settings to match current compliance and security requirements.

#### How the Test Works

This test retrieves GPO state from Active Directory using **Get-MtADGpoState** (it uses `$gpoState.GPOs`).

It then filters all GPOs where the `CreationTime` is earlier than **January 1st, 2020** and reports the resulting count.

#### Related Tests

- `Test-MtAdGpoTotalCount` - Total GPO inventory
- `Test-MtAdGpoUnlinkedCount` - GPOs not linked anywhere
- `Test-MtAdGpoLinkedCount` - GPOs that are actively linked

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-GPO-02 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Group Policy |
| Area | Infrastructure hardening |
| Resource type | GroupPolicy |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdGpoCreatedBefore2020Count](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPO-02.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read |

</details>

## Source

- Test: [`tests/ad/gpo/Test.AD-GPO-02.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPO-02.ps1)
- Documentation: [`tests/ad/gpo/Test.AD-GPO-02.md`](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPO-02.md)