> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/active-directory-entities/grouppolicyobject.md).

# GPO

| Field                           | Type        | Possible Operators                                             | Description                                                                                                                                                                                                                                                         |
| ------------------------------- | ----------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Guid                            | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | A unique identifier that is a combination of GUID of selected `Scan` and Active Directory `ObjectGUID` of the object.                                                                                                                                               |
| FSName                          | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | A special unique identifier that is a combination of the `Display Name of the object` and the `Fully Qualified Domain Name of the Domain`.                                                                                                                          |
| Name                            | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Name of the specified object. (**Ldap Display Name**: name)                                                                                                                                                                                                         |
| DistinguishedName               | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Active Directory distinguished name of the object. (**Ldap Display Name**: distinguishedName)                                                                                                                                                                       |
| PolicyRules                     | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Contains group policy object settings in XML format.                                                                                                                                                                                                                |
| Flags                           | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Indicates the state of the GPO. (**Ldap Display Name**: flags) ([Field Reference](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpod/d360d288-d7d5-49a9-83be-603805da1379))                                                                      |
| Cn                              | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The name that represents an object. Used to perform searches. (**Ldap Display Name**: cn)                                                                                                                                                                           |
| Passwords                       | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Plain-text passwords in Group Policy related configuration files.                                                                                                                                                                                                   |
| unrolled\_linked\_entity\_count | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The total number of objects that are affected by the group policy.                                                                                                                                                                                                  |
| WhenChanged                     | DATE        | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | The date when this object was last changed. (**Ldap Display Name**: whenChanged)                                                                                                                                                                                    |
| GPCFileSysPath                  | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | SYSVOL Policy folder path of the group policy object. (**Ldap Display Name**: gPCFileSysPath)                                                                                                                                                                       |
| DisplayName                     | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Indicates the friendly name of the GPO specified by the Group Policy administrator. (**LDAP Display Name**: displayName)                                                                                                                                            |
| WhenCreated                     | DATE        | SMALLER, LARGER, BETWEEN, EQUAL, IS\_EMPTY                     | The date when this object was created. (**Ldap Display Name**: whenCreated)                                                                                                                                                                                         |
| VersionNumber                   | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | A general purpose version number. (**Ldap Display Name**: versionNumber)                                                                                                                                                                                            |
| GPCFunctionalityVersion         | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The version of the Group Policy Editor that created this object. (**Ldap Display Name**: gPCFunctionalityVersion)                                                                                                                                                   |
| risk                            | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The risk score of the object that calculated based on vulnerability counts and severities.                                                                                                                                                                          |
| GPCMachineExtensionNames        | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | lists the GUIDs of client-side extensions (CSEs) linked to a Group Policy Object (GPO) that apply machine-level settings                                                                                                                                            |
| IsCriticalSystemObject          | BOOLEAN     | N/A (toggle)                                                   | N/A                                                                                                                                                                                                                                                                 |
| IsEmpty                         | BOOLEAN     | N/A (toggle)                                                   | Indicates whether the Group Policy Object (GPO) contains any policy rules; it is `true` if `PolicyRules` is null or empty, meaning the GPO has no defined policies.                                                                                                 |
| ObjectClass                     | TEXT        | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | It tells **what kind of object** the entry is, and more importantly, **what set of attributes** that object can or must have.                                                                                                                                       |
| ExposurePoint                   | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | **ExposurePoint**: A numerical value indicating the level of risk or exposure.                                                                                                                                                                                      |
| AceAuditState                   | MULTI\_LIST | IN                                                             | SACL audit coverage of the object's permissions (ACEs): `Full` when every ACE is covered by a success audit rule, `Partial` when some are, `None` when none are. Set only when the scan runs the permission (over-privilege) analysis. Values: None, Partial, Full. |
| IsContentReadFailed             | BOOLEAN     | N/A (toggle)                                                   | Indicates whether Forestall could not read the GPO's policy content from SYSVOL.                                                                                                                                                                                    |
| Tier                            | NUMBER      | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Tier level Forestall assigned to the object: `0` (Tier 0), `1` (Tier 1) or `2` (Tier 2). Lower is more privileged.                                                                                                                                                  |