| Guid |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
A unique identifier that is a combination of GUID of selected Scan and Active Directory ObjectGUID of the object. |
| Name |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
Name of the specified object. (Ldap Display Name: name) |
| FSName |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
A special unique identifier that is a combination of the Name of the object and the Fully Qualified Domain Name of the Domain. |
| IsEnabled |
BOOLEAN |
N/A (toggle) |
Indicates whether the account is enabled. |
| HasConstrainedDelegation |
BOOLEAN |
N/A (toggle) |
Indicates whether the Constrained Delegation is activated on the object. |
| LogonCount |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
The number of times the account has successfully logged on. This attribute is not replicated to other Domain Controllers. (Ldap Display Name: logonCount) |
| PrimaryGroupID |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
Contains the relative identifier (RID) for the primary group of the object. (Ldap Display Name: primaryGroupID) |
| UserAccountControl |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
Flags that control different attributes and behavior of the objects. (Ldap Display Name: userAccountControl) (Field Reference) |
| PasswordExpirationDate |
DATE |
SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY |
The expiration date of the object’s password. |
| IsSensitive |
BOOLEAN |
N/A (toggle) |
Indicates whether the object’s NOT_DELEGATED bit of UserAccountControl is set. This attribute is used to disable Kerberos delegations for objects. |
| IsUsingDESAlgorithmForHashing |
BOOLEAN |
N/A (toggle) |
Indicates whether the object is using an insecure DES algorithm in Kerberos protocol. |
| IsAdmin |
BOOLEAN |
N/A (toggle) |
Indicates that the object is Admin. |
| IsPasswordExpired |
BOOLEAN |
N/A (toggle) |
Indicates whether the object’s password is expired and should be changed. |
| WhenCreated |
DATE |
SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY |
The date when this object was created. (Ldap Display Name: whenCreated) |
| HasResourceBasedConstrainedDelegation |
BOOLEAN |
N/A (toggle) |
Indicates whether the Resource Based Constrained Delegation is activated on the object. |
| Cn |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
The name that represents an object. Used to perform searches. (Ldap Display Name: cn) |
| AllowedtoDelegateSpn |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
Contains Service Principal Name definitions in the context of Constrained Delegation. (LDAP Display Name: msDS-AllowedToDelegateTo) |
| HasUnconstrainedDelegation |
BOOLEAN |
N/A (toggle) |
Indicates whether the Unconstrained Delegation is activated on the object. |
| session_count |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
Indicates that how many sessions the object has on computers. |
| MsDSSupportedEncryptionTypes |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
The encryption algorithms supported by user, computer or trust accounts. The KDC uses this information while generating a service ticket for this account. Services and Computers can automatically update this attribute on their respective accounts in Active Directory, and therefore need write access to this attribute. (LDAP Display Name: msDS-SupportedEncryptionTypes) |
| IsProtected |
BOOLEAN |
N/A (toggle) |
Indicates that the object is a direct or nested member of the Protected Users group. |
| IsPrivileged |
BOOLEAN |
N/A (toggle) |
Indicates that the object is Privileged. |
| ObjectSid |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
Active Directory security identifier of object. (Ldap Display Name: objectSid) |
| first_degree_localadmin_count |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
Indicates that the account has explicit local admin privilege on how many computers. |
| HasReversibleEncryption |
BOOLEAN |
N/A (toggle) |
Indicates whether the object is using reversible encryption instead of hash to keep credentials. |
| BadPwdCount |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
The number of times the object tried to log on to the account using an incorrect password. (Ldap Display Name: badPwdCount) |
| AdminCount |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
Indicates that a given object has had its ACLs changed to a more secure value by the system because it was a member of one of the administrative groups (directly or transitively). (Ldap Display Name: adminCount) |
| risk |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
The risk score of the object that calculated based on vulnerability counts and severities. |
| DistinguishedName |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
Active Directory distinguished name of the object. (Ldap Display Name: distinguishedName) |
| HasProtocolTransition |
BOOLEAN |
N/A (toggle) |
Indicates whether the Constrained Delegation with Protocol transition is activated on the object. |
| SidHistory |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
Contains previous SIDs used for the object if the object was moved from another domain. Whenever an object is moved from one domain to another, a new SID is created and that new SID becomes the objectSID. The previous SID is added to the sIDHistory property. (Ldap Display Name: sIDHistory) |
| SAMAccountType |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
Specifies the account type of the security principal objects in Active Directory. (LDAP Display Name: sAMAccountType) (Field Reference) |
| DNSHostName |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
Full qualified domain name of group managed service account as registered in DNS. (Ldap Display Name: dNSHostName) |
| DontReqPreauth |
BOOLEAN |
N/A (toggle) |
Indicates whether the Kerberos Pre-Authentication mechanism was disabled for the object. |
| MsDSManagedPasswordInterval |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
This attribute is used to retrieve the number of days before a managed password is automatically changed for a group MSA. (Ldap Display Name: msDS-ManagedPasswordInterval) |
| group_delegated_localadmin_count |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
Indicates that the object has group delegated local admin privilege on how many computers. |
| IsLocalAdmin |
BOOLEAN |
N/A (toggle) |
Indicates that the object is a member (direct or nested) of a local administrators group in at least one computer. |
| DontReqPasswd |
BOOLEAN |
N/A (toggle) |
Indicates whether the object’s password can be blank. |
| HasNonExpiringPassword |
BOOLEAN |
N/A (toggle) |
Indicates whether the object’s password is set to never expire. |
| HasLocalService |
BOOLEAN |
N/A (toggle) |
Indicates whether the object has managing local services (without SPN). |
| SAMAccountName |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
The logon name used to support clients and servers running earlier versions of the operating system, such as Windows NT 4.0, Windows 95, Windows 98, and LAN Manager. (Ldap Display Name: sAMAccountName) |
| WhenChanged |
DATE |
SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY |
The date when this object was last changed. (Ldap Display Name: whenChanged) |
| IsInactive |
BOOLEAN |
N/A (toggle) |
Indicates whether a computer has been enabled but unused (no logon) for a period longer than the defined inactivity threshold |
| LastLogonTimestamp |
DATE |
SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY |
The time that the user last logged into the domain. This attribute is replicated to other Domain Controllers but not updated until after 14 (msDS-LogonTimeSyncInterval) days. (Ldap Display Name: lastLogonTimestamp) |
| ServicePrincipalName |
TEXT |
LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY |
These SPN entries indicate that the computer has Kerberos service identifiers registered for both its hostname and fully qualified domain name under the HOST and RestrictedKrbHost service classes, allowing it to securely participate in Kerberos authentication. |
| ExposurePoint |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
ExposurePoint: A numerical value indicating the level of risk or exposure. |
| IsShadow |
BOOLEAN |
N/A (toggle) |
Indicates that the object can compromise admin objects with at least one attack path. |
| AceAuditState |
MULTI_LIST |
IN |
SACL audit coverage of the object’s permissions (ACEs): Full when every ACE is covered by a success audit rule, Partial when some are, None when none are. Set only when the scan runs the permission (over-privilege) analysis. Values: None, Partial, Full. |
| Tier |
NUMBER |
EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL |
Tier level Forestall assigned to the object: 0 (Tier 0), 1 (Tier 1) or 2 (Tier 2). Lower is more privileged. |
