Skip to main content
Version: 2.3.0

AD-GPOREP-19 - No GPOs should contain a default password

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Test-MtAdGpoDefaultPasswordFoundCount​

Counts the number of GPOs that contain a default password.

Why This Test Matters​

  • Detective control: counts GPOs where a default password is found in the report.

Control Type​

Detective

Security Recommendation​

  • Investigate and remediate GPOs that embed default passwords.

How the Test Works​

  • Retrieves GPO state, filters DefaultPasswordFound, and reports totals and a percentage.
  • Test-MtAdGpoDefaultPasswordFoundDetails.

Test Metadata​

FieldValue
Test IDAD-GPOREP-19
SeverityHigh
SuiteActive Directory
CategoryAD.GPOState
PowerShell testTest-MtAdGpoDefaultPasswordFoundCount
TagsAD, AD-GPOREP-19, AD.GPOState

Source​

  • Pester test: tests/ad/gpostate/Test-MtAdGpoDefaultPasswordFoundCount.Tests.ps1
  • PowerShell source: powershell/public/ad/gpostate/Test-MtAdGpoDefaultPasswordFoundCount.ps1