GPO

Field	Type	Possible Operators	Description
Guid	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	A unique identifier that is a combination of GUID of selected Scan and Active Directory ObjectGUID of the object.
FSName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	A special unique identifier that is a combination of the Display Name of the object and the Fully Qualified Domain Name of the Domain.
Name	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Name of the specified object. (Ldap Display Name: name)
DistinguishedName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Active Directory distinguished name of the object. (Ldap Display Name: distinguishedName)
PolicyRules	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Contains group policy object settings in XML format.
Flags	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Indicates the state of the GPO. (Ldap Display Name: flags) (Field Reference)
Cn	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	The name that represents an object. Used to perform searches. (Ldap Display Name: cn)
Passwords	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Plain-text passwords in Group Policy related configuration files.
unrolled_linked_entity_count	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	The total number of objects that are affected by the group policy.
WhenChanged	DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	The date when this object was last changed. (Ldap Display Name: whenChanged)
GPCFileSysPath	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	SYSVOL Policy folder path of the group policy object. (Ldap Display Name: gPCFileSysPath)
DisplayName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Indicates the friendly name of the GPO specified by the Group Policy administrator. (LDAP Display Name: displayName)
WhenCreated	DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	The date when this object was created. (Ldap Display Name: whenCreated)
VersionNumber	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	A general purpose version number. (Ldap Display Name: versionNumber)
GPCFunctionalityVersion	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	The version of the Group Policy Editor that created this object. (Ldap Display Name: gPCFunctionalityVersion)
risk	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	The risk score of the object that calculated based on vulnerability counts and severities.
GPCMachineExtensionNames	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	lists the GUIDs of client-side extensions (CSEs) linked to a Group Policy Object (GPO) that apply machine-level settings
IsCriticalSystemObject	BOOLEAN	N/A (toggle)	N/A
IsEmpty	BOOLEAN	N/A (toggle)	Indicates whether the Group Policy Object (GPO) contains any policy rules; it is true if PolicyRules is null or empty, meaning the GPO has no defined policies.
ObjectClass	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	It tells what kind of object the entry is, and more importantly, what set of attributes that object can or must have.
ExposurePoint	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	ExposurePoint: A numerical value indicating the level of risk or exposure.
AceAuditState	MULTI_LIST	IN	SACL audit coverage of the object’s permissions (ACEs): Full when every ACE is covered by a success audit rule, Partial when some are, None when none are. Set only when the scan runs the permission (over-privilege) analysis. Values: None, Partial, Full.
IsContentReadFailed	BOOLEAN	N/A (toggle)	Indicates whether Forestall could not read the GPO’s policy content from SYSVOL.
Tier	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Tier level Forestall assigned to the object: 0 (Tier 0), 1 (Tier 1) or 2 (Tier 2). Lower is more privileged.