> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/active-directory-entities/group.md). # Group | Field | Type | Possible Operators | Description | | -------------------------------- | ----------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Guid | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | A unique identifier that is a combination of GUID of selected `Scan` and Active Directory `ObjectGUID` of the object. | | FSName | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | A special unique identifier that is a combination of the `Name of the object` and the `Fully Qualified Domain Name of the Domain`. | | ObjectSid | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Active Directory security identifier of object. (**Ldap Display Name**: objectSid) | | Name | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Name of the specified object. (**Ldap Display Name**: name) | | DistinguishedName | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Active Directory distinguished name of the object. (**Ldap Display Name**: distinguishedName) | | IsPrivileged | BOOLEAN | N/A (toggle) | Indicates that the object is Privileged. | | IsAdmin | BOOLEAN | N/A (toggle) | Indicates that the object is Admin. | | WhenChanged | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY | The date when this object was last changed. (**Ldap Display Name**: whenChanged) | | IsProtected | BOOLEAN | N/A (toggle) | Indicates that the object is a direct or nested member of the Protected Users group. | | WhenCreated | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY | The date when this object was created. (**Ldap Display Name**: whenCreated) | | risk | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The risk score of the object that calculated based on vulnerability counts and severities. | | member\_count | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The total count of the direct member objects. | | SAMAccountName | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | The logon name used to support clients and servers running earlier versions of the operating system, such as Windows NT 4.0, Windows 95, Windows 98, and LAN Manager. (**Ldap Display Name**: sAMAccountName) | | Cn | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | The name that represents an object. Used to perform searches. (**Ldap Display Name**: cn) | | SidHistory | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Contains previous SIDs used for the object if the object was moved from another domain. Whenever an object is moved from one domain to another, a new SID is created and that new SID becomes the objectSID. The previous SID is added to the sIDHistory property. (**Ldap Display Name**: sIDHistory) | | GroupType | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Contains a set of flags that define the type and scope of a group object. (**Ldap Display Name**: ) | | SAMAccountType | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Specifies the account type of the security principal objects in Active Directory. (**LDAP Display Name**: sAMAccountType) ([Field Reference](https://learn.microsoft.com/en-us/windows/win32/adschema/a-samaccounttype)) | | first\_degree\_localadmin\_count | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Indicates that the group has explicit local admin privilege on how many computers. | | Description | TEXT | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY | Description text to display for an object. (**Ldap Display Name**: description) | | AdminCount | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Indicates that a given object has had its ACLs changed to a more secure value by the system because it was a member of one of the administrative groups (directly or transitively). (**Ldap Display Name**: adminCount) | | IsLocalAdmin | BOOLEAN | N/A (toggle) | Indicates that the object is a member (direct or nested) of a local administrators group in at least one computer. | | ExposurePoint | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | **ExposurePoint**: A numerical value indicating the level of risk or exposure. | | IsShadow | BOOLEAN | N/A (toggle) | Indicates that the object can compromise admin objects with at least one attack path. | | AceAuditState | MULTI\_LIST | IN | SACL audit coverage of the object's permissions (ACEs): `Full` when every ACE is covered by a success audit rule, `Partial` when some are, `None` when none are. Set only when the scan runs the permission (over-privilege) analysis. Values: None, Partial, Full. | | Tier | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Tier level Forestall assigned to the object: `0` (Tier 0), `1` (Tier 1) or `2` (Tier 2). Lower is more privileged. |