> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/active-directory-entities/certificateauthority.md). # CertificateAuthority | Field | Type | Possible Operators | Description | | ----------------------------------------- | ----------- | -------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Guid | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | A unique identifier that is a combination of GUID of selected `Scan` and Active Directory `ObjectGUID` of the object. | | FSName | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | A special unique identifier that is a combination of the `Name of the object` and the `FSName of the Forest`. | | DistinguishedName | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Active Directory distinguished name of the object. (**Ldap Display Name**: distinguishedName) | | IsWebEnrollmentEnabled | BOOLEAN | N/A (toggle) | Whether the certificate authority server supports web-based enrollment for the clients. | | AllowsUserSpecifiedSANs | BOOLEAN | N/A (toggle) | Whether specifying a Subject Alternative Name (SAN) during certificate enrollment to any certificate template that is published by this certificate authority server has been allowed. | | CertificateManagerRestrictions | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Some organizations require further restrictions on certificate manager activities. Rather than allow a certificate manager to issue or revoke any certificate issued by a CA, the organization might want a certificate manager to only manage a subset of all certificates. Specified property contains the defined certificate manager restrictions on the certificate authority. The data in this column formatted as, `Name of the Certificate Manager`,`Name of the Template` ,`Name of the Principal`,`Access Type`. The definition is, `Name of the Certificate Manager` has `Access Type` rights on `Name of the Principal` to manage the `Name of the Template` template. | | EnrollmentAgentRestrictions | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | An enrollment agent is a user who can enroll for a certificate on behalf on another client. Unlike a certificate manager, an enrollment agent can only process the enrollment request and cannot approve pending requests or revoke issued certificates. Some organizations require further restrictions on enrollment agents. Rather than allow a certificate request agent to to enroll on behalf any client issued by a CA, the organization might want a certificate request agent to only enroll on behalf of a subset of all certificate templates or clients. Specified property contains the defined certificate request agent restrictions on the certificate authority. The data in this column formatted as, `Name of the Enrollment Agent`,`Name of the Template` ,`Name of the Principal`,`Access`. The definition is, `Name of the Enrollment Agent` has `Access Type` rights to enroll on behalf of `Name of the Principal` to the `Name of the Template` certificate template. | | IsAdmin | BOOLEAN | N/A (toggle) | Indicates that the object is Admin. | | DNSHostName | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Fully qualified domain name of computer as registered in DNS. (**Ldap Display Name**: dNSHostName) | | CertificateEnrollmentWebServiceUrls | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Certificate enrollment web service url addresses of the certificate authority. | | FullName | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Combination of the DNSHostName and the Name of the certificate authority. | | WhenChanged | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY | The date when this object was last changed. (**Ldap Display Name**: whenChanged) | | isEnterpriseCA | BOOLEAN | N/A (toggle) | Whether the certificate authority is an enterprise certificate authority instance. Enterprise certificate authorities are domain members and typically online to issue certificates or certificate policies. | | inComputerName | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | FSName of the computer that contains the certificate authority instance. | | CAEnrollmentInterfacesEPADisabled | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | The Web-based endpoints of the certificate authority with Extended Authentication Protection (EPA) disabled. | | WhenCreated | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY | The date when this object was created. (**Ldap Display Name**: whenCreated) | | EnterpriseCAName | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Name of the CA server, specified in the ADCS installation. | | inComputerGuid | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Guid of the computer that contains the certificate authority instance. | | risk | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The risk score of the object that calculated based on vulnerability counts and severities. | | CaCertificateDN | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Full distinguished name from the CA certificate. | | CAEnrollmentInterfacesHTTPEnabled | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | The Web-based endpoints of the certificate authority with HTTP enabled. | | isRootCA | BOOLEAN | N/A (toggle) | Whether the certificate authority is an root certificate authority instance. The root certificate authorities are the first and may be the only certificate authorities configured in a Public Key Infrastructure(PKI) hierarchy. | | DisplayName | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | The display name for an object. (**LDAP Display Name**: displayName) | | CertificateEnrollmentPolicyWebServiceUrls | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Certificate enrollment policy web service url addresses of the certificate authority. | | NetworkDeviceEnrollmentServiceUrls | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Network device enrollment url addresses of the certificate authority. | | CAWebEnrollmentUrls | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Certificate authority web enrollment url addresses of the certificate authority. | | CAFlags | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | The certificate authority flags attribute stores the bitwise combination of the certificate authority server's capabilities. | | ExposurePoint | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | **ExposurePoint**: A numerical value indicating the level of risk or exposure. | | AceAuditState | MULTI\_LIST | IN | SACL audit coverage of the object's permissions (ACEs): `Full` when every ACE is covered by a success audit rule, `Partial` when some are, `None` when none are. Set only when the scan runs the permission (over-privilege) analysis. Values: None, Partial, Full. | | Tier | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Tier level Forestall assigned to the object: `0` (Tier 0), `1` (Tier 1) or `2` (Tier 2). Lower is more privileged. |