> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/active-directory-entities/domain.md).

# Domain

| Field                   | Type        | Possible Operators                                             | Description                                                                                                                                                                                                                                                         |
| ----------------------- | ----------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Guid                    | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | A unique identifier that is a combination of GUID of selected `Scan` and Active Directory `ObjectGUID` of the object.                                                                                                                                               |
| FSName                  | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Fully Qualified Domain Name of the Domain.                                                                                                                                                                                                                          |
| ObjectSid               | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Active Directory security identifier of object. (**Ldap Display Name**: objectSid)                                                                                                                                                                                  |
| Name                    | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Name of the specified object. (**Ldap Display Name**: name)                                                                                                                                                                                                         |
| DistinguishedName       | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Active Directory distinguished name of the object. (**Ldap Display Name**: distinguishedName)                                                                                                                                                                       |
| FSMORoleOwner           | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Flexible Single-Master Operation: The distinguished name of the DC where the schema can be modified. (**Ldap Display Name**: fSMORoleOwner)                                                                                                                         |
| WhenChanged             | DATE        | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | The date when this object was last changed. (**Ldap Display Name**: whenChanged)                                                                                                                                                                                    |
| MsDSMachineAccountQuota | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The number of computer accounts that a user is allowed to create in a domain. (**Ldap Display Name**: ms-DS-MachineAccountQuota)                                                                                                                                    |
| WhenCreated             | DATE        | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | The date when this object was created. (**Ldap Display Name**: whenCreated)                                                                                                                                                                                         |
| LockoutThreshold        | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The number of invalid logon attempts that are permitted before the account is locked out. (**Ldap Display Name**: lockoutThreshold)                                                                                                                                 |
| DomainMode              | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The operating mode of the domain. ([Field reference](https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.activedirectory.domainmode?view=windowsdesktop-7.0))                                                                                     |
| MinPwdLength            | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The minimum number of characters that a password must contain. (**Ldap Display Name**: minPwdLength)                                                                                                                                                                |
| DomainModeLevel         | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The operating mode level of the domain. ([Field Reference](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/6dd88965-8feb-4369-ae7e-075985da8071))                                                                                             |
| risk                    | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The risk score of the object that calculated based on vulnerability counts and severities.                                                                                                                                                                          |
| IsEnumerable            | BOOLEAN     | N/A (toggle)                                                   | Indicates the Forestall enumeration status of the domain.                                                                                                                                                                                                           |
| PwdProperties           | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | A bitfield to indicate complexity and storage restrictions. (**Ldap Display Name**: pwdProperties) ([Field Reference](https://learn.microsoft.com/en-us/windows/win32/adschema/a-pwdproperties))                                                                    |
| IsRecycleBinEnabled     | BOOLEAN     | N/A (toggle)                                                   | Indicates whether the recycle bin is activated for the domain.                                                                                                                                                                                                      |
| IsRootDomain            | BOOLEAN     | N/A (toggle)                                                   | Indicates whether the domain is the root of the forest.                                                                                                                                                                                                             |
| PwdHistoryLength        | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The number of old passwords to save. (**Ldap Display Name**: pwdHistoryLength)                                                                                                                                                                                      |
| InfrastructureRoleOwner | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Domain controller that holds the infrastructure owner role.                                                                                                                                                                                                         |
| RidRoleOwner            | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Domain controller that holds the relative identifier (RID) master role for this domain.                                                                                                                                                                             |
| NetbiosName             | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The name of the object to be used over NetBIOS. (**Ldap Display Name**: nETBIOSName)                                                                                                                                                                                |
| PdcRoleOwner            | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Domain controller that holds the primary domain controller (PDC) for this domain.                                                                                                                                                                                   |
| ExposurePoint           | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | **ExposurePoint**: A numerical value indicating the level of risk or exposure.                                                                                                                                                                                      |
| AceAuditState           | MULTI\_LIST | IN                                                             | SACL audit coverage of the object's permissions (ACEs): `Full` when every ACE is covered by a success audit rule, `Partial` when some are, `None` when none are. Set only when the scan runs the permission (over-privilege) analysis. Values: None, Partial, Full. |
| Tier                    | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Tier level Forestall assigned to the object: `0` (Tier 0), `1` (Tier 1) or `2` (Tier 2). Lower is more privileged.                                                                                                                                                  |