> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/active-directory-entities/dnsnode.md).

# DNSNode

A DNS Node is the Active Directory object (`dnsNode`) that backs a single DNS record inside an AD-integrated DNS zone. Every hostname, service record, and IP mapping stored in the directory is one `dnsNode` beneath its `dnsZone`. Forestall enumerates these records, including planted or spoofed ones like `wpad` or wildcard entries, alongside the rest of the directory.

### DNS Node Fields

| Field             | Type        | Possible Operators                                             | Description                                                                                                                                                                                                                                                         |
| ----------------- | ----------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| FSName            | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The display name of the DNS node object.                                                                                                                                                                                                                            |
| Name              | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The record name (the hostname or label within the zone).                                                                                                                                                                                                            |
| DistinguishedName | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The full LDAP distinguished name of the `dnsNode` object.                                                                                                                                                                                                           |
| risk              | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Risk score calculated by Forestall.                                                                                                                                                                                                                                 |
| AceAuditState     | MULTI\_LIST | IN                                                             | SACL audit coverage of the object's permissions (ACEs): `Full` when every ACE is covered by a success audit rule, `Partial` when some are, `None` when none are. Set only when the scan runs the permission (over-privilege) analysis. Values: None, Partial, Full. |
| Guid              | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Unique identifier of the object in Forestall, a combination of the selected scan's GUID and the object's own identifier.                                                                                                                                            |
| WhenCreated       | DATE        | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | Date and time the object was created.                                                                                                                                                                                                                               |
| WhenChanged       | DATE        | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | Date and time the object was last changed.                                                                                                                                                                                                                          |
| ExposurePoint     | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Exposure point score calculated by Forestall.                                                                                                                                                                                                                       |
| Tier              | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Tier level Forestall assigned to the object: `0` (Tier 0), `1` (Tier 1) or `2` (Tier 2). Lower is more privileged.                                                                                                                                                  |