Skip to main content
Version: 2.3.0

AD-GPOS-08 - GPO owner distinct count should be retrievable

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Test-MtAdGpoOwnerDistinctCount​

Counts the number of distinct GPO owners.

Why This Test Matters​

  • Operational control: assesses diversity of GPO owners which can highlight unusual configurations or omissions.

Control Type​

Operational

Security Recommendation​

  • If many owners are identical or blank, review GPO creation practices to ensure proper ownership.

How the Test Works​

  • Retrieves GPO state, extracts Owner fields, computes distinct non-empty owners, and reports the count.
  • Test-MtAdGpoOwnerDetails - summarizes owners per GPOs.

Test Metadata​

FieldValue
Test IDAD-GPOS-08
SeverityInfo
SuiteActive Directory
CategoryAD.GPOState
PowerShell testTest-MtAdGpoOwnerDistinctCount
TagsAD, AD-GPOS-08, AD.GPOState

Source​

  • Pester test: tests/ad/gpostate/Test-MtAdGpoOwnerDistinctCount.Tests.ps1
  • PowerShell source: powershell/public/ad/gpostate/Test-MtAdGpoOwnerDistinctCount.ps1