Skip to main content
Version: 2.3.0

AD-GPOREP-14 - GPO enforcement count should be retrievable

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Test-MtAdGpoEnforcementCount​

Counts the number of GPOs that have enforced GPO links.

Why This Test Matters​

  • Detective control: counts GPOs with enforced links which indicates explicit policy delivery is configured.

Control Type​

Operational

Security Recommendation​

  • Ensure enforcement aligns with security policy; adjust as needed for least privilege and correct policy propagation.

How the Test Works​

  • Fetches GPO state, filters for HasEnforcement, and reports total GPOs, number with enforcement, and the ratio.
  • Test-MtAdGpoEnforcementCount.

Test Metadata​

FieldValue
Test IDAD-GPOREP-14
SeverityInfo
SuiteActive Directory
CategoryAD.GPOState
PowerShell testTest-MtAdGpoEnforcementCount
TagsAD, AD-GPOREP-14, AD.GPOState

Source​

  • Pester test: tests/ad/gpostate/Test-MtAdGpoEnforcementCount.Tests.ps1
  • PowerShell source: powershell/public/ad/gpostate/Test-MtAdGpoEnforcementCount.ps1