> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/ad-identities/domains.md).

# Domains

The `Domains` page provides a list of enumerated Domains in entire Active Directory. The list contains the `Risk Score` , `Exposure Point` and `Issue Counts` of each domain object.

<figure><img src="/files/k0t4cW7WgVbigXwQmTuk" alt=""><figcaption><p>Domains</p></figcaption></figure>

## Domain Details

Details page contains the `Risk Score` of the domain,`Exposure Point`, `Details` tab, `GPOs` tab, `Visualize` button, `Issues` and `Trusts` panes.

{% hint style="info" %}
You can analyze objects in the `Graph module` by clicking the `Visualize` button on the upper left side.
{% endhint %}

<figure><img src="/files/fmuJeMWZuauA5TvO8IZk" alt=""><figcaption><p>Domain Details</p></figcaption></figure>

## Details

Details tab contains attributes below about domain.

| Attribute                     | Description                                                                                                                                                                                      |
| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Distinguished Name**        | Active Directory distinguished name of the object. (**Ldap Display Name**                                                                                                                        |
| **Domain Mode**               | The operating mode of the domain. ([Field reference](https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.activedirectory.domainmode?view=windowsdesktop-7.0))                  |
| **PDC Role Owner**            | Domain controller that holds the primary domain controller (PDC) for this domain.                                                                                                                |
| **Object Sid**                | Active Directory security identifier of object. (**Ldap Display Name**: objectSid)                                                                                                               |
| **Created Time**              | The date when this object was created. (**Ldap Display Name**: whenCreated)                                                                                                                      |
| **Last Changed Time**         | The date when this object was last changed. (**Ldap Display Name**: whenChanged)                                                                                                                 |
| **ms-DS-MachineAccountQuota** | The number of computer accounts that a user is allowed to create in a domain. (**Ldap Display Name**: ms-DS-MachineAccountQuota)                                                                 |
| **FSMO Role Owner**           | Flexible Single-Master Operation: The distinguished name of the DC where the schema can be modified. (**Ldap Display Name**: fSMORoleOwner)                                                      |
| **Netbios Name**              | The name of the object to be used over NetBIOS. (**Ldap Display Name**: nETBIOSName)                                                                                                             |
| **Domain Mode Level**         | The operating mode level of the domain. ([Field Reference](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/6dd88965-8feb-4369-ae7e-075985da8071))                          |
| **RID Role Owner**            | Domain controller that holds the relative identifier (RID) master role for this domain.                                                                                                          |
| **Minimum Password Length**   | The minimum number of characters that a password must contain. (**Ldap Display Name**: minPwdLength)                                                                                             |
| **Password History Length**   | The number of old passwords to save. (**Ldap Display Name**: pwdHistoryLength)                                                                                                                   |
| **Password Properties**       | A bitfield to indicate complexity and storage restrictions. (**Ldap Display Name**: pwdProperties) ([Field Reference](https://learn.microsoft.com/en-us/windows/win32/adschema/a-pwdproperties)) |
| **Lockout Threshold**         | The number of invalid logon attempts that are permitted before the account is locked out. (**Ldap Display Name**: lockoutThreshold)                                                              |
| **Infrastructure Role Owner** | Domain controller that holds the infrastructure owner role.                                                                                                                                      |

## GPOs

GPOs tab contains a list of `Group Policy` objects which linked to the domain object. This list also contains `Enforcement Status` and `Link Order` of the group policy objects. You can go to the details page of the group policy object by clicking the name.

<figure><img src="/files/s7qUYQ8gZzbHz1Wc00NF" alt=""><figcaption><p>GPOs</p></figcaption></figure>

## Issues

Issues pane contains identified issues on the domain object.

![Issues](/files/siqP5uoOaydQF3s3YOvv)

## Trusts

Trusts pane contains trust relationships of the domain object and attributes about the trust.

![Trusts](/files/PLZaA1Mmhx16grDTR8hS)

**Target Domain**: The name of the domain with which a trust exists.

**Direction**: Indicates in which direction the trust flows. ([Field Reference](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/5026a939-44ba-47b2-99cf-386a9e674b04))

**Active**: Indicates whether the trust is actively used or not. The activity threshold is 40 days. (**Ldap Display Name**: whenChanged)

**Transitive**: Indicates whether the trust is transitive or not. Transitive trust refers to a trust relationship between two domains that allows authentication and authorization to be passed through multiple domains in a chain.

**Selective Authentication**: Authentication type of a trust. True if the authentication of the trust is selective; false if the authentication is domain or forest wide. Selective authentication allows control over which objects in a trusted domain can access resources in the trusting domain.

**SID Filtering**: SID filtering status of a trust. True if SID filtering is enabled; otherwise, false. SID (Security Identifier) filtering is a security mechanism used in Microsoft Active Directory to prevent security principal (user or group) impersonation with SIDHistory.

**TGT Delegation**: Indicates whether the TGT delegation across trusts is active or not. TGT delegation allows a domain controller to forward authentication requests to another domain controller without the need to re-authenticate. This is also known as cross-domain authentication or cross-forest authentication.

**Type**: Indicates the type of trust. ([Field Reference](https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.activedirectory.trusttype?view=windowsdesktop-7.0))