AD-GPO-04: Unlinked GPO count should be compliant


ID	`AD-GPO-04`
Severity	Low
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Group Policy
Security area	Infrastructure hardening
Resource type	GroupPolicy
User impact of fixing	Low
Effort to fix	Medium
Reads from	On-premises Active Directory

What this checks and how to fix it

Unlinked (or orphaned) Group Policy Objects (GPOs) exist in Active Directory but are not linked to any OU, domain, or site. While they may look harmless, they can still create operational and security risk:

Resource and operational overhead: Unused GPOs add clutter and can increase administrative effort.
Accidental exposure: An unlinked GPO can be mistakenly linked later, suddenly applying unknown settings to users or computers.
Harder incident investigation: Policy behavior becomes harder to reason about when unused GPOs remain in the environment.

Control Type

Detective

Security Recommendation

After verification, remove unlinked GPOs to reduce risk and simplify policy management:

Confirm the GPO’s purpose (documentation, change history, owners).
Verify it is not required for any special-case deployment path.
If you are confident it is unused, remove it (or archive it) and ensure backups/restore requirements are met.
Restrict who can create/link GPOs to prevent accidental re-introduction.

How the Test Works

This test retrieves Active Directory Group Policy state data using Get-MtADGpoState and:

Uses the cached list of GPOs ($gpoState.GPOs).
Extracts GPO link references from the collected GPOLinks (via gPLink).
Counts GPOs whose IDs are not referenced by any collected gPLink entry.

Test-MtAdGpoTotalCount - Counts the total number of GPOs
Test-MtAdGpoLinkedCount - Identifies GPOs that are actively linked
Test-MtAdGpoCreatedBefore2020Count - Identifies potentially outdated GPOs

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).