AD-GPOREP-02 - No GPOs should be missing permissions
Overview
Test-MtAdGpoNoPermissionsDetails
Returns details of GPO reports missing permissions.
Why This Test Matters
- Detective control: identifies GPO reports with missing permissions which could enable unintended access.
Control Type
Preventive
Security Recommendation
- Review and remediate missing permissions to ensure proper GPO deployment and ACLs.
How the Test Works
- Aggregates GPO reports, checks PermissionsPresent property, and lists reports lacking permissions in a Markdown table.
Related Tests
Test-MtAdGpoNoPermissionsCount.
Related links
- Microsoft Learn - Group Policy management
- ANSSI checkpoint: https://www.anssi.gouv.fr/
Test Metadata
| Field | Value |
|---|---|
| Test ID | AD-GPOREP-02 |
| Severity | Medium |
| Suite | Active Directory |
| Category | Active Directory - GPO State |
| PowerShell test | Test-MtAdGpoNoPermissionsDetails |
| Services | ActiveDirectory |
| Tags | AD, AD-GPOREP-02, AD.GPOState |
Source
- Test:
tests/ad/gpostate/Test.AD-GPOREP-02.ps1 - Documentation:
tests/ad/gpostate/Test.AD-GPOREP-02.md