Skip to main content
Version: 2.3.0

AD-GPOREP-01 - No GPOs should be missing permissions

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Test-MtAdGpoNoPermissionsCount​

Counts Group Policy Objects (GPOs) with missing permissions.

Why This Test Matters​

  • Detective control: counts GPO reports with missing permissions which could expose resources to unintended access.

Control Type​

Preventive

Security Recommendation​

  • Review and remediate missing permissions in GPO ACLs.

How the Test Works​

  • Fetches GPO state, filters for reports with PermissionsPresent false or null, and reports totals.
  • Test-MtAdGpoNoPermissionsDetails.

Test Metadata​

FieldValue
Test IDAD-GPOREP-01
SeverityMedium
SuiteActive Directory
CategoryAD.GPOState
PowerShell testTest-MtAdGpoNoPermissionsCount
TagsAD, AD-GPOREP-01, AD.GPOState

Source​

  • Pester test: tests/ad/gpostate/Test-MtAdGpoNoPermissionsCount.Tests.ps1
  • PowerShell source: powershell/public/ad/gpostate/Test-MtAdGpoNoPermissionsCount.ps1