Skip to content
MitoMito Docs

AD-GPOL-01: GPO linked count should be investigated
ID AD-GPOL-01
Severity Info
Suite Active Directory (on-premises)
Product Active Directory
Feature Group Policy
Security area Infrastructure hardening
Resource type GroupPolicy
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Linked Group Policy Objects (GPOs) are actively applying settings to users and/or computers across your Active Directory environment.

For security assessments, it is important to understand the scope of actively linked (and therefore applying) policies. This test helps you:

  • Identify the ratio of active vs unused policies
  • Spot environments where many GPOs exist but only a subset are actually applied
  • Prioritize review/cleanup efforts based on real policy exposure

Control Type

Section titled “Control Type”

Operational

Security Recommendation

Section titled “Security Recommendation”
  • Review linked (active) GPOs regularly: Linked policies can change security posture immediately when modified.
  • Audit unused/unlinked GPOs: Large numbers of unused policies can indicate mismanagement and increase the risk of accidental changes.
  • Use the linked ratio: A low linked ratio might indicate policy sprawl or a backlog of orphaned policies.

How the Test Works

Section titled “How the Test Works”

This test retrieves GPO state from Active Directory using Get-MtADGpoState (it uses $gpoState.GPOs and $gpoState.GPOLinks).

It then:

  1. Parses gPLink values to identify enabled (0) and enforced (2) link entries.
  2. Counts distinct GPO GUIDs that have at least one enabled link.
  3. Compares linked GPO count vs total GPO count and reports both metrics in Markdown.
Section titled “Related Tests”
  • Test-MtAdGpoTotalCount - Total GPO inventory
  • Test-MtAdGpoUnlinkedCount - GPOs not linked anywhere
  • Test-MtAdGpoCreatedBefore2020Count - Potentially legacy GPOs
  • Test-MtAdGpoChangedBefore2020Count - Potentially stale GPOs

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.