Skip to main content
Version: 3.0.0-preview

AD-GPOREP-05 - GPOs without enterprise domain controllers count should be retrievable

Michael Soule
Contributed by Michael SouleAll contributors →

Overview​

Control Type​

Detective

Test-MtAdGpoNoEnterpriseDcCount​

Counts GPO reports that do not include Enterprise Domain Controllers.

Why This Test Matters​

  • Detective control: flags GPO reports missing Enterprise Domain Controllers which could impact domain-wide policy targeting.

Security Recommendation​

  • Verify whether Enterprise DCs should be included; adjust policy accordingly.

How the Test Works​

  • Retrieves GPO state, enumerates GPO reports, and counts those without an access-allowed entry for Enterprise Domain Controllers (HasEnterpriseDomainControllers is false).
  • A GPO whose permissions could not be read is reported as not evaluated instead of as a finding. The result is then Investigate, or Skipped when no GPO could be evaluated.
  • Test-MtAdGpoNoEnterpriseDcCount.

Test Metadata​

FieldValue
Test IDAD-GPOREP-05
SeverityMedium
SuiteActive Directory
ProductActive Directory
FeatureGroup Policy
AreaAccess control
Resource typeGroupPolicy
User impactLow
Implementation costMedium
MITRE ATT&CKNone
PowerShell testTest-MtAdGpoNoEnterpriseDcCount
ServicesActiveDirectory
PermissionsActiveDirectory:Ldap:groupPolicyContainer.gPCFileSysPath:ReadProperty, ActiveDirectory:File:SYSVOL:Read

Source​