Skip to main content
Version: 3.0.0-preview

AD-GPOREP-03 - GPOs without authenticated users count should be retrievable

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Control Type​

Detective

Test-MtAdGpoNoAuthenticatedUsersCount​

Counts GPO reports that do not include Authenticated Users.

Why This Test Matters​

  • Detective control: counts GPO reports missing Authenticated Users which could widen access.

Security Recommendation​

  • Review missing Authenticated Users and adjust GPO ACLs as needed.

How the Test Works​

  • Uses Get-MtADGpoState, filters GPO reports for HasAuthenticatedUsers false or null, and reports totals.
  • Test-MtAdGpoNoAuthenticatedUsersDetails.

Test Metadata​

FieldValue
Test IDAD-GPOREP-03
SeverityMedium
SuiteActive Directory
CategoryActive Directory - GPO State
PowerShell testTest-MtAdGpoNoAuthenticatedUsersCount
ServicesActiveDirectory
TagsAD, AD-GPOREP-03, AD.GPOState

Source​