AD-GPOREP-02 - No GPOs should be missing permissions

Contributed by Michael SouleAll contributors →

Overview

Test-MtAdGpoNoPermissionsDetails

Returns details of GPO reports missing permissions.

Why This Test Matters

• Detective control: identifies GPO reports with missing permissions which could enable unintended access.

Control Type

Preventive

Security Recommendation

• Review and remediate missing permissions to ensure proper GPO deployment and ACLs.

How the Test Works

• Aggregates GPO reports, checks PermissionsPresent property, and lists reports lacking permissions in a Markdown table.

Related Tests

• Test-MtAdGpoNoPermissionsCount.

Related links

• Microsoft Learn - Group Policy management
• ANSSI checkpoint: https://www.anssi.gouv.fr/

Test Metadata

Field	Value
Test ID	AD-GPOREP-02
Severity	Medium
Suite	Active Directory
Category	AD.GPOState
PowerShell test	Test-MtAdGpoNoPermissionsDetails
Tags	AD, AD-GPOREP-02, AD.GPOState

Source

• Pester test: tests/ad/gpostate/Test-MtAdGpoNoPermissionsDetails.Tests.ps1
• PowerShell source: powershell/public/ad/gpostate/Test-MtAdGpoNoPermissionsDetails.ps1