AD-GPOREP-01 - No GPOs should be missing permissions
Overview
Test-MtAdGpoNoPermissionsCount
Counts Group Policy Objects (GPOs) with missing permissions.
Why This Test Matters
- Detective control: counts GPO reports with missing permissions which could expose resources to unintended access.
Control Type
Preventive
Security Recommendation
- Review and remediate missing permissions in GPO ACLs.
How the Test Works
- Fetches GPO state, filters for reports with PermissionsPresent false or null, and reports totals.
Related Tests
Test-MtAdGpoNoPermissionsDetails.
Related links
- Microsoft Learn - Group Policy management
- ANSSI checkpoint: https://www.anssi.gouv.fr/
Test Metadata
| Field | Value |
|---|---|
| Test ID | AD-GPOREP-01 |
| Severity | Medium |
| Suite | Active Directory |
| Category | Active Directory - GPO State |
| PowerShell test | Test-MtAdGpoNoPermissionsCount |
| Services | ActiveDirectory |
| Tags | AD, AD-GPOREP-01, AD.GPOState |
Source
- Test:
tests/ad/gpostate/Test.AD-GPOREP-01.ps1 - Documentation:
tests/ad/gpostate/Test.AD-GPOREP-01.md