# Unlinked GPO count should be compliant

Unlinked (or orphaned) Group Policy Objects (GPOs) exist in Active Directory but are not linked to any OU, domain, or site.

Source: https://maester.dev/docs/tests/AD-GPO-04

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Group Policy · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-GPO-04
```

## Overview

Unlinked (or orphaned) Group Policy Objects (GPOs) exist in Active Directory but are not linked to any OU, domain, or site. While they may look harmless, they can still create operational and security risk:

- **Resource and operational overhead**: Unused GPOs add clutter and can increase administrative effort.
- **Accidental exposure**: An unlinked GPO can be mistakenly linked later, suddenly applying unknown settings to users or computers.
- **Harder incident investigation**: Policy behavior becomes harder to reason about when unused GPOs remain in the environment.

#### Control Type

**Detective**

#### Security Recommendation

After verification, **remove unlinked GPOs** to reduce risk and simplify policy management:

- Confirm the GPO’s purpose (documentation, change history, owners).
- Verify it is not required for any special-case deployment path.
- If you are confident it is unused, remove it (or archive it) and ensure backups/restore requirements are met.
- Restrict who can create/link GPOs to prevent accidental re-introduction.

#### How the Test Works

This test retrieves Active Directory Group Policy state data using `Get-MtADGpoState` and:

1. Uses the cached list of GPOs (`$gpoState.GPOs`).
2. Extracts GPO link references from the collected `GPOLinks` (via `gPLink`).
3. Counts GPOs whose IDs are not referenced by any collected `gPLink` entry.

#### Related Tests

- `Test-MtAdGpoTotalCount` - Counts the total number of GPOs
- `Test-MtAdGpoLinkedCount` - Identifies GPOs that are actively linked
- `Test-MtAdGpoCreatedBefore2020Count` - Identifies potentially outdated GPOs

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-GPO-04 |
| Severity | Low |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Group Policy |
| Area | Infrastructure hardening |
| Resource type | GroupPolicy |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdGpoUnlinkedCount](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPO-04.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read |

</details>

## Source

- Test: [`tests/ad/gpo/Test.AD-GPO-04.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPO-04.ps1)
- Documentation: [`tests/ad/gpo/Test.AD-GPO-04.md`](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPO-04.md)