Skip to main content
Version: 2.3.0

AD-GPOREP-16 - No GPOs should have version mismatches

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Test-MtAdGpoVersionMismatchDetails​

Returns details of GPOs with a version mismatch.

Why This Test Matters​

  • Detective control: identifies GPOs where the version reported has a mismatch, potentially indicating stale or misapplied policy definitions.

Control Type​

Detective

Security Recommendation​

  • Validate GPO versions against a known baseline and correct mismatches to ensure consistent policy behavior.

How the Test Works​

  • Fetches GPO state, filters GPOReports for HasVersionMismatch being true, and presents a table of mismatched GPOs.
  • Test-MtAdGpoVersionMismatchCount - counts GPOs with version mismatches.

Test Metadata​

FieldValue
Test IDAD-GPOREP-16
SeverityHigh
SuiteActive Directory
CategoryAD.GPOState
PowerShell testTest-MtAdGpoVersionMismatchDetails
TagsAD, AD-GPOREP-16, AD.GPOState

Source​

  • Pester test: tests/ad/gpostate/Test-MtAdGpoVersionMismatchDetails.Tests.ps1
  • PowerShell source: powershell/public/ad/gpostate/Test-MtAdGpoVersionMismatchDetails.ps1