Skip to main content
Version: 2.3.0

AD-GPOREP-08 - GPOs with deny ACE details should be retrievable

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Control Type​

Detective

Test-MtAdGpoDenyAceDetails​

Returns details of GPO reports that include a Deny ACE.

Why This Test Matters​

  • Detective control: lists GPO reports that contain a Deny ACE which could block legitimate policy application.

Security Recommendation​

  • Review and minimize Deny ACE usage; remove unnecessary permissions to reduce risk.

How the Test Works​

  • Reads GPO state, selects reports where HasDenyAce is true, and outputs a Markdown table of such GPOs.
  • Test-MtAdGpoDenyAceCount.

Test Metadata​

FieldValue
Test IDAD-GPOREP-08
SeverityUnknown
SuiteActive Directory
CategoryAD.GPOState
PowerShell testTest-MtAdGpoDenyAceDetails
TagsAD, AD-GPOREP-08, AD.GPOState

Source​

  • Pester test: tests/ad/gpostate/Test-MtAdGpoDenyAceDetails.Tests.ps1
  • PowerShell source: powershell/public/ad/gpostate/Test-MtAdGpoDenyAceDetails.ps1