Skip to main content
Version: 3.0.0-preview

AD-GPOREP-10 - GPO no-apply Group Policy ACE count should be investigated

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Test-MtAdGpoNoApplyGroupPolicyAceCount​

Counts the number of GPOs missing the "Apply Group Policy" ACE.

Why This Test Matters​

  • Detective control: counts GPOs missing the Apply Group Policy ACE which governs policy application.

Control Type​

Operational

Security Recommendation​

  • Ensure the ACE is present on necessary GPOs or document why it is absent.

How the Test Works​

  • Evaluates GPO reports for HasApplyGroupPolicyAce, counts missing ACE occurrences, and provides a sample list.
  • Test-MtAdGpoNoApplyGroupPolicyAceDetails.

Test Metadata​

FieldValue
Test IDAD-GPOREP-10
SeverityInfo
SuiteActive Directory
CategoryActive Directory - GPO State
PowerShell testTest-MtAdGpoNoApplyGroupPolicyAceCount
ServicesActiveDirectory
TagsAD, AD-GPOREP-10, AD.GPOState

Source​