Skip to main content
Version: 2.3.0

AD-GPOREP-09 - GPO inherited permissions count should be retrievable

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Control Type​

Operational

Test-MtAdGpoInheritedPermissionsCount​

Counts GPO reports with inherited permissions.

Why This Test Matters​

  • Detective control: checks for inherited permissions in GPOs which may lead to broader access than intended.

Security Recommendation​

  • Review inherited permissions and consider removing inheritance where not needed.

How the Test Works​

  • Scans GPO state for HasInheritedPermissions true and reports counts and a small sample.
  • Test-MtAdGpoInheritedPermissionsCount.

Test Metadata​

FieldValue
Test IDAD-GPOREP-09
SeverityUnknown
SuiteActive Directory
CategoryAD.GPOState
PowerShell testTest-MtAdGpoInheritedPermissionsCount
TagsAD, AD-GPOREP-09, AD.GPOState

Source​

  • Pester test: tests/ad/gpostate/Test-MtAdGpoInheritedPermissionsCount.Tests.ps1
  • PowerShell source: powershell/public/ad/gpostate/Test-MtAdGpoInheritedPermissionsCount.ps1