AD-GPOREP-08 - GPOs with deny ACE details should be retrievable

Contributed by Michael SouleAll contributors →

Overview

Control Type

Detective

Test-MtAdGpoDenyAceDetails

Returns details of GPO reports that include a Deny ACE.

Why This Test Matters

• Detective control: lists GPO reports that contain a Deny ACE which could block legitimate policy application.

Security Recommendation

• Review and minimize Deny ACE usage; remove unnecessary permissions to reduce risk.

How the Test Works

• Reads GPO state, selects reports where HasDenyAce is true, and outputs a Markdown table of such GPOs.

Related Tests

• Test-MtAdGpoDenyAceCount.

Related links

• Microsoft Learn - Group Policy management
• ANSSI checkpoint: https://www.anssi.gouv.fr/

Test Metadata

Field	Value
Test ID	AD-GPOREP-08
Severity	Medium
Suite	Active Directory
Category	Active Directory - GPO State
PowerShell test	Test-MtAdGpoDenyAceDetails
Services	ActiveDirectory
Tags	AD, AD-GPOREP-08, AD.GPOState

Source

• Test: tests/ad/gpostate/Test.AD-GPOREP-08.ps1
• Documentation: tests/ad/gpostate/Test.AD-GPOREP-08.md