Skip to main content
Version: 2.3.0

AD-GPOS-04 - Disabled GPO settings count should be retrievable

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Test-MtAdGpoSettingsDisabledCount​

Counts GPOs where settings are disabled (AllDisabled, UserDisabled, or ComputerDisabled).

Why This Test Matters​

  • Detective control: checks how many GPOs have disabled settings (AllDisabled, UserDisabled, ComputerDisabled).

Control Type​

Operational

Security Recommendation​

  • Review disabled settings to confirm they are intentional and document exceptions if needed.

How the Test Works​

  • Counts GPOs whose GpoStatus maps to a disabled state and reports totals and ratios.
  • Test-MtAdGpoAllSettingsDisabledDetails and Test-MtAdGpoSettingsDisabledCount.

Test Metadata​

FieldValue
Test IDAD-GPOS-04
SeverityInfo
SuiteActive Directory
CategoryAD.GPOState
PowerShell testTest-MtAdGpoSettingsDisabledCount
TagsAD, AD-GPOS-04, AD.GPOState

Source​

  • Pester test: tests/ad/gpostate/Test-MtAdGpoSettingsDisabledCount.Tests.ps1
  • PowerShell source: powershell/public/ad/gpostate/Test-MtAdGpoSettingsDisabledCount.ps1