> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/introduction/glossary/glossary.md). # Active Directory Glossary The glossary focuses on how Active Directory objects are categorized, how privilege\ tiers such as Tier 0 are determined, and how relationships between objects can impact\ the overall security posture of the environment. ## **Active Directory Object / Entity** The term Object or Entity refers to objects in the Active Directory environment. The scan enumerates and analyzes the objects/entities below. * Forest * Domain * Computer * User * Group * Group Policy Object * Organizational Unit * Managed Service Account * Group Managed Service Account * Delegated Managed Service Account (dMSA) * Local User * Local Group * Certificate Authority * Certificate Template * Certificate Authority Certificate Search & Reports also covers Containers, Service Principal Names, Fine-Grained Password Policies, logon/startup Scripts, Unknown Trusts, Display Specifiers, DNS Zones and DNS Nodes. ## Tier0 ### What “Tier 0” Means Tier 0 objects hold the keys to your entire Active Directory (AD) forest. Anyone who can control a Tier 0 object can ultimately control every other object. For that reason, Tier 0 assets must be managed only from equally protected Tier 0 workstations by the most-trusted admins. ### Which Objects Are Always Tier 0 | Type | Name in Active Directory | | --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Group Policy Object (GPO)** | Default Domain Policy | | **Organizational Unit (OU)** | Domain Controllers | | **Container** | Users and AdminSDHolder | | **Built-in or Privileged Groups** |

• Dns Admins

• Domain Admins

• Domain Controllers

• Cert Publishers

• Cloneable Domain Controllers

• Key Admins

• Enterprise Key Admins

• Schema Admins

• Enterprise Admins

• Built-in Administrators

• Account Operators

• Server Operators

• Print Operators

• Backup Operators

• Distributed COM Users

• Cryptographic Operators

• Enterprise Domain Controllers

• Performance Log Users

• Incoming Forest Trust Builders

| | **Built-in Users** |

• Administrator

• krbtgt

| #### How Everything Else Gets Its Tier | **Groups** |

• Group is on the “Tier 0 groups” list.

• Group is a member (directly or through nesting) of any Tier 0 group.

| | ------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Computers & Servers** |

• Computer is a Domain Controller.

• Computer hosts an Active Directory Certificate Authority (CA).

• Computer is a member (directly or through nesting) of any Tier 0 group.

• Computer is added to a Tier 0 group that lives in another trusted domain.

| | **Users** |

• User is on the “Tier 0 users” list.

• User is a member (directly or through nesting) of any Tier 0 group.

• User is added to a Tier 0 group that lives in another trusted domain.

| | **Local Users** | • Local User is local administrator on a Tier 0 computer. | | **Service Accounts**(MSA, gMSA, dMSA) |

• Service Account is a member (directly or through nesting) of any Tier 0 group.

• Service Account is added to a Tier 0 group that lives in another trusted domain.

| | **Certificate Templates** | The template is published in Active Directory Certificate Services. | | **Organizational Units (OUs)** | OU copies the highest-privilege tier of anything stored inside it. If any child object is Tier 0, the OU becomes Tier 0. | | **Containers** | Same rule as OUs: the container takes the highest tier of its contents. | | **Group Policy Objects (GPOs)** |

• GPO linked directly to the domain root.

• GPO linked to any OU or container that is Tier 0.

| | **Logon / Startup Scripts** | A script takes the highest tier of every GPO that assigns it. If one GPO is Tier 0, the script is Tier 0. | #### Environment-specific Tier 0 and Tier 2 * You can add your own Tier 0 users, computers, groups, MSAs, gMSAs, dMSAs and OUs in the scan policy. They are treated as Tier 0 in addition to the built-in rules. * Entra Connect (Azure AD Connect) synchronization identities (`MSOL_*`, `AAD_*`, the ADSync service account), the synchronization server and the `ADSyncAdmins` and `ADSyncPasswordSet` groups are Tier 0. * Every object that is not Tier 0 is labelled **Tier 2**. ### **Admin** Objects that have direct privilege on the entire Active Directory environment or that can lead to total Active Directory compromise. Forestall marks the following objects as Admin. * Direct or nested members of * Administrators * Domain Admins * Enterprise Admins * Domain Controller Servers * KRBTGT * Certificate Authorities ## **Privileged** Objects that have direct privilege on some Active Directory objects or that can lead to compromise of Admin objects. Forestall marks the following objects as Privileged. * All Admin objects * Direct or nested members of * Account Operators * Backup Operators * Cert Publishers * Cryptographic Operators * DnsAdmins * Enterprise Key Admins * Enterprise Read-only Domain Controllers * Group Policy Creator Owners * Incoming Forest Trust Builders * Key Admins * Network Configuration Operators * Print Operators * Read-only Domain Controllers * Remote Desktop Users * Replicator * Schema Admins ## **Unprivileged** All other objects that are not privileged or admin. ## **Everyone-Like** Groups that contain all/general objects in Active Directory. Forestall marks the following objects as Everyone-Like. * Everyone * World * Anonymous * Authenticated Users * Users * Guests * Domain Guests * Domain Users * Domain Computers ## **Local Admin** Objects that have direct or nested membership on local Administrators group in at least one computer. ## **Service Account** Users with the ServicePrincipalNames attribute set. ## **Explicit Local Admin** Objects that have direct membership on local Administrators group. ## **Group Delegated Local Admin** Objects that have nested membership on local Administrators group. ## **Online** Computers reachable on port 445 (SMB) during the network scan. ## **Shadow Admin** Unprivileged or privileged objects that can compromise admin objects through attack paths.