# GPO unlinked details should be compliant

Unlinked Group Policy Objects (GPOs) are policies that exist in Active Directory but are not linked to any site, domain, or organizational unit (OU).

Source: https://maester.dev/docs/tests/AD-GPO-05

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Group Policy · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-GPO-05
```

## Overview

Unlinked Group Policy Objects (GPOs) are policies that exist in Active Directory but are not linked to any
site, domain, or organizational unit (OU). Even when unlinked, these GPOs still represent configuration
artifacts that can create operational overhead and increase risk.

- **Security risk**: Unused policies may still contain insecure settings that could be re-enabled accidentally.
- **Operational complexity**: GPO sprawl makes it harder to reason about what policies actually apply.
- **Maintenance hygiene**: Tracking unlinked GPOs supports safe cleanup and ongoing policy governance.

#### Control Type

**Operational**

#### Security Recommendation

Review the returned unlinked GPOs and consider removing those that are no longer needed.

This reduces the attack surface by removing unused policies that could be re-linked or misconfigured
in the future.

#### How the Test Works

This test uses `Get-MtADGpoState` to retrieve cached GPO data (`$gpoState.GPOs`). It then identifies unlinked
GPOs and generates a markdown table containing:

- **GPO DisplayName**
- **CreationTime**
- **ModificationTime**

The table is intended to support quick review during GPO cleanup and maintenance activities.

#### Related Tests

- `Test-MtAdGpoUnlinkedCount` - Identifies how many GPOs are not linked to any location
- `Test-MtAdGpoLinkedCount` - Counts GPOs that are actively linked
- `Test-MtAdGpoTotalCount` - Counts the total number of GPOs in the domain

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-GPO-05 |
| Severity | Low |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Group Policy |
| Area | Infrastructure hardening |
| Resource type | GroupPolicy |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdGpoUnlinkedDetails](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPO-05.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read |

</details>

## Source

- Test: [`tests/ad/gpo/Test.AD-GPO-05.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPO-05.ps1)
- Documentation: [`tests/ad/gpo/Test.AD-GPO-05.md`](https://github.com/maester365/maester/blob/main/tests/ad/gpo/Test.AD-GPO-05.md)