Skip to main content
Version: 2.3.0

AD-GPOS-07 - All disabled GPO settings details should be compliant

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Test-MtAdGpoAllSettingsDisabledDetails​

Returns details of GPOs where all settings are disabled.

Why This Test Matters​

  • Detective control: lists GPOs where all settings are disabled which can be a sign of misconfiguration or excessive restriction.

Control Type​

Operational

Security Recommendation​

  • Review fully disabled GPOs; decide whether to re-enable or remove them.

How the Test Works​

  • Identifies GPOs with GpoStatus AllDisabled and renders a detailed MD table of those GPOs.
  • Test-MtAdGpoAllSettingsDisabledDetails is the current test; other related tests include state-wide counts.

Test Metadata​

FieldValue
Test IDAD-GPOS-07
SeverityInfo
SuiteActive Directory
CategoryAD.GPOState
PowerShell testTest-MtAdGpoAllSettingsDisabledDetails
TagsAD, AD-GPOS-07, AD.GPOState

Source​

  • Pester test: tests/ad/gpostate/Test-MtAdGpoAllSettingsDisabledDetails.Tests.ps1
  • PowerShell source: powershell/public/ad/gpostate/Test-MtAdGpoAllSettingsDisabledDetails.ps1