AD-GPOS-03 - WMI filter details should be compliant
Overview
Test-MtAdGpoWmiFilterDetails
Returns details of GPOs with a WMI filter configuration.
Why This Test Matters
- Detective control: detects GPOs with a non-empty WMI filter, which can influence policy scope per machine.
Control Type
Operational
Security Recommendation
- Review WMI-filtered GPOs to ensure filters are intentional and correctly scoped.
How the Test Works
- Retrieves GPO state, filters for Gpos with a non-empty WmiFilter, and renders a Markdown table with details.
Related Tests
Test-MtAdGpoWmiFilterCount.
Related links
- Microsoft Learn - Group Policy management
- ANSSI checkpoint: https://www.anssi.gouv.fr/
Test Metadata
| Field | Value |
|---|---|
| Test ID | AD-GPOS-03 |
| Severity | Info |
| Suite | Active Directory |
| Category | AD.GPOState |
| PowerShell test | Test-MtAdGpoWmiFilterDetails |
| Tags | AD, AD-GPOS-03, AD.GPOState |
Source
- Pester test:
tests/ad/gpostate/Test-MtAdGpoWmiFilterDetails.Tests.ps1 - PowerShell source:
powershell/public/ad/gpostate/Test-MtAdGpoWmiFilterDetails.ps1