Skip to main content
Version: 2.3.0

AD-GPOREP-18 - No GPOs should contain a cpassword

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Test-MtAdGpoCpasswordFoundDetails​

Returns details of GPOs that contain a cpassword.

Why This Test Matters​

  • Detective control: detects GPOs that contain a Cpassword which could be exploited if leaked.
  • Cpasswords expose sensitive credentials and should be protected.

Control Type​

Detective

Security Recommendation​

  • Rotate or remove the cpasswords where necessary and apply proper protection controls.

How the Test Works​

  • Uses Get-MtADGpoState to obtain GPO data, filters for reports where CpasswordFound is true, and formats a Markdown table.
  • Test-MtAdGpoCpasswordFoundCount - counts GPOs with cpasswords.

Test Metadata​

FieldValue
Test IDAD-GPOREP-18
SeverityCritical
SuiteActive Directory
CategoryAD.GPOState
PowerShell testTest-MtAdGpoCpasswordFoundDetails
TagsAD, AD-GPOREP-18, AD.GPOState

Source​

  • Pester test: tests/ad/gpostate/Test-MtAdGpoCpasswordFoundDetails.Tests.ps1
  • PowerShell source: powershell/public/ad/gpostate/Test-MtAdGpoCpasswordFoundDetails.ps1