Skip to content
MitoMito Docs

AD-GPOL-03: GPO unlinked target count should be compliant
ID AD-GPOL-03
Severity Low
Suite Active Directory (on-premises)
Product Active Directory
Feature Group Policy
Security area Infrastructure hardening
Resource type OrganizationalUnit
User impact of fixing Low
Effort to fix Medium
Reads from On-premises Active Directory

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Active Directory targets (OUs, the domain root, and sites) without any Group Policy links may indicate incomplete security policy coverage.

When a target has no GPO links, security and configuration baselines may not be applied consistently—creating gaps that attackers or misconfigurations can exploit.

Control Type

Section titled “Control Type”

Operational

Security Recommendation

Section titled “Security Recommendation”

Investigate any unlinked targets and remediate the policy coverage gap:

  • Confirm the target should receive baseline policies (security requirements, ownership, and intended design).
  • Add the appropriate GPO links (typically security baselines and auditing policies) to restore consistent enforcement.
  • Review GPO inheritance/blocking design to ensure links are not unintentionally prevented.
  • Maintain a deployment cadence so new OUs/domains/sites do not remain unlinked.

Unlinked targets can represent missing or outdated configurations, so treat results as potential security configuration gaps.

How the Test Works

Section titled “How the Test Works”

This test uses Get-MtADGpoState (and its cached GPOLinks/AD data) and:

  1. Enumerates all OUs using Get-ADOrganizationalUnit.
  2. Reads the gPLink value for the domain root.
  3. Identifies site link objects from Get-MtADGpoState ($gpoState.SiteContainers).
  4. Counts each target whose gPLink value contains no GPO GUID references (i.e., no GPO links).
Section titled “Related Tests”
  • Test-MtAdGpoUnlinkedCount - Identifies GPOs that are not linked to any location
  • Test-MtAdGpoLinkedCount - Counts distinct GPOs that are actively linked
  • Test-MtAdGpoUnlinkedDetails - Returns details of unlinked GPOs
  • Test-MtAdGpoLinkedOUCount - (if implemented) OUs with GPO links

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.