Skip to main content
Version: 2.3.0

AD-GPOREP-06 - GPOs without domain computers count should be retrievable

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Control Type​

Detective

Test-MtAdGpoNoDomainComputersCount​

Counts GPO reports that do not include Domain Computers.

Why This Test Matters​

  • Detective control: identifies GPO reports missing Domain Computers which could impact scope or applicability.

Security Recommendation​

  • Verify whether Domain Computers should be included and adjust GpoReports as needed to reflect accurate targeting.

How the Test Works​

  • Reads GPO state, locates GpoReports, filters for reports with HasDomainComputers false or missing, and reports counts and samples.
  • Test-MtAdGpoNoDomainComputersCount.

Test Metadata​

FieldValue
Test IDAD-GPOREP-06
SeverityUnknown
SuiteActive Directory
CategoryAD.GPOState
PowerShell testTest-MtAdGpoNoDomainComputersCount
TagsAD, AD-GPOREP-06, AD.GPOState

Source​

  • Pester test: tests/ad/gpostate/Test-MtAdGpoNoDomainComputersCount.Tests.ps1
  • PowerShell source: powershell/public/ad/gpostate/Test-MtAdGpoNoDomainComputersCount.ps1