Skip to main content
Version: 3.0.0-preview

AD-GPOS-03 - WMI filter details should be investigated

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Test-MtAdGpoWmiFilterDetails​

Returns details of GPOs with a WMI filter configuration.

Why This Test Matters​

  • Detective control: detects GPOs with a non-empty WMI filter, which can influence policy scope per machine.

Control Type​

Operational

Security Recommendation​

  • Review WMI-filtered GPOs to ensure filters are intentional and correctly scoped.

How the Test Works​

  • Retrieves GPO state, filters for Gpos with a non-empty WmiFilter, and renders a Markdown table with details.
  • Test-MtAdGpoWmiFilterCount.

Test Metadata​

FieldValue
Test IDAD-GPOS-03
SeverityInfo
SuiteActive Directory
CategoryActive Directory - GPO State
PowerShell testTest-MtAdGpoWmiFilterDetails
ServicesActiveDirectory
TagsAD, AD-GPOS-03, AD.GPOState

Source​