Skip to main content
Version: 3.0.0-preview

AD-GPOREP-13 - GPO disabled link details should be investigated

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Test-MtAdGpoDisabledLinkDetails​

Returns details of GPOs with disabled GPO links.

Why This Test Matters​

  • Detective control: checks for GPOs with disabled links to identify potential misconfigurations that could affect policy delivery.
  • Disabled links can lead to unexpected policy application gaps.

Control Type​

Operational

Security Recommendation​

  • Review and re-enable intentional GPO links or remove unused GPOs to restore intended policy application.

How the Test Works​

  • Retrieves GPO state via Get-MtADGpoState, filters GPOReports for DisabledLinks greater than 0, and renders a Markdown table with the results.
  • Test-MtAdGpoDisabledLinkCount - Count of disabled links across GPOs.

Test Metadata​

FieldValue
Test IDAD-GPOREP-13
SeverityInfo
SuiteActive Directory
CategoryActive Directory - GPO State
PowerShell testTest-MtAdGpoDisabledLinkDetails
ServicesActiveDirectory
TagsAD, AD-GPOREP-13, AD.GPOState

Source​