AD-GPOREP-07 - GPOs with deny ACE count should be retrievable
Overview
Control Type
Detective
Test-MtAdGpoDenyAceCount
Counts GPO reports that include a Deny ACE.
Why This Test Matters
- Detective control: checks for Deny ACEs in GPO reports which can override permissions.
Security Recommendation
- Review or remove Deny ACEs to ensure proper permission handling.
How the Test Works
- Aggregates GPO reports, counts those with HasDenyAce true, and reports totals and a sample of affected GPOs.
Related Tests
Test-MtAdGpoDenyAceDetails.
Related links
- Microsoft Learn - Group Policy management
- ANSSI checkpoint: https://www.anssi.gouv.fr/
Test Metadata
| Field | Value |
|---|---|
| Test ID | AD-GPOREP-07 |
| Severity | Unknown |
| Suite | Active Directory |
| Category | AD.GPOState |
| PowerShell test | Test-MtAdGpoDenyAceCount |
| Tags | AD, AD-GPOREP-07, AD.GPOState |
Source
- Pester test:
tests/ad/gpostate/Test-MtAdGpoDenyAceCount.Tests.ps1 - PowerShell source:
powershell/public/ad/gpostate/Test-MtAdGpoDenyAceCount.ps1