AD-GPO-03: GPO stale-before-2020 count should be investigated
| ID | AD-GPO-03 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Group Policy |
| Security area | Infrastructure hardening |
| Resource type | GroupPolicy |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Group Policy Objects (GPOs) that have not been modified for a long time can become “stale”. Stale GPOs may contain outdated security configurations, which can create security gaps if they no longer match your current security baselines.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Regularly review GPOs that have not changed recently. Consider:
- Validating that security settings are still required and aligned with your current baseline
- Removing or updating policies that are no longer used or no longer appropriate
- Establishing a review cadence for long-lived policies
How the Test Works
Section titled “How the Test Works”This test uses Get-MtADGpoState to retrieve cached GPO data.
It filters GPOs where ModificationTime is earlier than 2020-01-01 and calculates:
- Total number of GPOs
- Number and percentage of stale GPOs
Related Tests
Section titled “Related Tests”Test-MtAdGpoTotalCount- Counts the total number of GPOs
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.