AD-GPOREP-15 - No GPOs should have version mismatches

Contributed by Michael SouleAll contributors →

Overview

Test-MtAdGpoVersionMismatchCount

Counts the number of GPOs with a version mismatch.

Why This Test Matters

• Detective control: flags GPOs that have a version mismatch which could affect policy consistency across machines.

Control Type

Detective

Security Recommendation

• Review mismatched GPOs and align versions with baseline configurations.

How the Test Works

• Pulls GPO state, filters HasVersionMismatch, counts total/mismatched and computes a mismatch ratio.

Related Tests

• Test-MtAdGpoVersionMismatchDetails.

Related links

• Microsoft Learn - Group Policy management
• ANSSI checkpoint: https://www.anssi.gouv.fr/

Test Metadata

Field	Value
Test ID	AD-GPOREP-15
Severity	High
Suite	Active Directory
Category	AD.GPOState
PowerShell test	Test-MtAdGpoVersionMismatchCount
Tags	AD, AD-GPOREP-15, AD.GPOState

Source

• Pester test: tests/ad/gpostate/Test-MtAdGpoVersionMismatchCount.Tests.ps1
• PowerShell source: powershell/public/ad/gpostate/Test-MtAdGpoVersionMismatchCount.ps1