Skip to main content
Version: 3.0.0-preview

AD-GPOREP-19 - No GPOs should contain a default password

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Test-MtAdGpoDefaultPasswordFoundCount​

Counts the number of GPOs that contain a default password.

Why This Test Matters​

  • Detective control: counts GPOs where a default password is found in the report.

Control Type​

Detective

Security Recommendation​

  • Investigate and remediate GPOs that embed default passwords.

How the Test Works​

  • Retrieves GPO state, filters DefaultPasswordFound, and reports totals and a percentage.
  • Test-MtAdGpoDefaultPasswordFoundDetails.

Test Metadata​

FieldValue
Test IDAD-GPOREP-19
SeverityHigh
SuiteActive Directory
CategoryActive Directory - GPO State
PowerShell testTest-MtAdGpoDefaultPasswordFoundCount
ServicesActiveDirectory
TagsAD, AD-GPOREP-19, AD.GPOState

Source​