> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/ad-identities/groups.md).

# Groups

The `Groups` page provides a list of enumerated groups in entire Acitve Directory. The list contains the `Privileged`, `Admin`, `Local Admin`, `Member Count`, `Risk Score`,`Exposure Point` and `Issue Counts`.

<figure><img src="/files/jbwIpsgoj6ubVedqdt56" alt=""><figcaption><p>Groups</p></figcaption></figure>

## Group Details

Details page contains the `Risk Score` of the group,`Exposure Point`, `Information`, and `Issues` panes.

{% hint style="info" %}
You can analyze objects in the `Graph module` by clicking the `Visualize` button on the upper left side of the `Information Pane`.
{% endhint %}

<figure><img src="/files/Sg1PZnFIHhiUghf6R8Wx" alt=""><figcaption><p>Group Details</p></figcaption></figure>

## Information

`Information Pane` can contain different badges to highlight important attributes.

| Badge           | Description                                                                                                        |
| --------------- | ------------------------------------------------------------------------------------------------------------------ |
| **Privileged**  | Indicates that the object is Privileged.                                                                           |
| **Admin**       | Indicates that the object is Admin.                                                                                |
| **Local Admin** | Indicates that the object is a member (direct or nested) of a local administrators group in at least one computer. |

`Information Pane` contains `Details`, `Parent Groups`, `Child Groups`, `Child Users`, `Child Computers,Child MSAs` , `Child GMSAs` and `Local Memberships` tabs respectively.

## Details

Details tab contains attributes below about group object.

| Attribute              | Description                                                                                                                                                                                                   |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **SAM AccountName**    | The logon name used to support clients and servers running earlier versions of the operating system, such as Windows NT 4.0, Windows 95, Windows 98, and LAN Manager. (**Ldap Display Name**: sAMAccountName) |
| **Distinguished Name** | Active Directory distinguished name of the object. (**Ldap Display Name**: distinguishedName)                                                                                                                 |
| **Object Category**    | An object class name used to group objects of this or derived classes. (**Ldap Display Name**: objectCategory)                                                                                                |
| **Object Sid**         | Active Directory security identifier of object. (**Ldap Display Name**: objectSid)                                                                                                                            |
| **Parent OU**          | The direct parent Organizational Unit of the object.                                                                                                                                                          |
| **Name**               | Name of the specified object. (**Ldap Display Name**: name)                                                                                                                                                   |
| **Created Time**       | The date when this object was created. (**Ldap Display Name**: whenCreated)                                                                                                                                   |
| **Last Changed Time**  | The date when this object was last changed. (**Ldap Display Name**: whenChanged)                                                                                                                              |
| **Description**        | Description text to display for an object. (**Ldap Display Name**: description)                                                                                                                               |

## Parent Groups

Parent Groups tab contains a list of groups that the group is a member of. This list also contains `Privileged` and `Admin` columns to identify the privilege levels of these groups.

<figure><img src="/files/B2PKwMsX7CY2FlZT7uqB" alt=""><figcaption><p>Parent Groups</p></figcaption></figure>

## Child Groups

Child Groups tab contains a list of groups that are children of the group. This list also contains `Privileged` and `Admin` columns to identify the privilege levels of these groups.

<figure><img src="/files/PSUUmV7PPHzkkYKHpc1f" alt=""><figcaption><p>Child Groups</p></figcaption></figure>

## Child Users

The Child Users tab displays a list of user accounts associated with the group.

<figure><img src="/files/AouhtkU2EOSP2VBqX8mb" alt=""><figcaption><p>Child Users</p></figcaption></figure>

**Name**: The name of the user account.

**Privileged**: Indicates whether the user has elevated privileges.

**Admin**: Indicates whether the user has administrative rights.

**Enabled**: Indicates whether the user account is active.

## Child Computers

The Child Computers tab displays a list of computer objects associated with the group.

<figure><img src="/files/hZujFyUxK6M6njJxs02N" alt=""><figcaption><p>Child Computers</p></figcaption></figure>

**Name**: The name of the computer object.

**IP Address**: The IP address assigned to the computer.

**Privileged**: Indicates whether the computer object has elevated privileges.

**Admin**: Indicates whether the computer object has administrative rights.

**Enabled**: Indicates whether the computer object is enabled.

## Child MSAs

The Child MSAs tab displays a list of Managed Service Accounts (MSAs) associated with the group.

<figure><img src="/files/AFcZphZUAu8u7dxDEnTk" alt=""><figcaption><p>Child MSAs</p></figcaption></figure>

**Name**: The name of the Managed Service Account.

**Privileged**: Indicates whether the MSA has elevated privileges.

**Admin**: Indicates whether the MSA has administrative rights.

**Enabled**: Indicates whether the MSA is active.

## Child GMSAs

The Child GMSAs tab displays a list of Group Managed Service Accounts (GMSAs) associated with the group.

<figure><img src="/files/2u2X2G78dixevvAJXDzB" alt=""><figcaption><p>Child GMSAs</p></figcaption></figure>

**Name**: The name of the Group Managed Service Account.

**Privileged**: Indicates whether the GMSA has elevated privileges.

**Admin**: Indicates whether the GMSA has administrative rights.

**Enabled**: Indicates whether the GMSA is active.

## Child DMSAs

The Child DMSAs tab displays a list of Delegated Managed Service Accounts (DMSAs) associated with the group.

<figure><img src="/files/NflM3fwcv1V8EtRxGUT1" alt=""><figcaption><p>Child DMSAs</p></figcaption></figure>

**Name**: The name of the Delegated Managed Service Account.

**Privileged**: Indicates whether the DMSA has elevated privileges.

**Admin**: Indicates whether the DMSA has administrative rights.

**Enabled**: Indicates whether the DMSA is active.

## Local Memberships

Local Memberships tab contains a list of local groups that the group is a member of.

<figure><img src="/files/hLVhYX4xdG4KVZa1qdD2" alt=""><figcaption><p>Local Memberships</p></figcaption></figure>

**Local Group Name**: Name of the local group that the group is a member of.

**Computer**: Name of the computer object that contains the local group.

**Exec DCOM**: Indicates whether the local group can have enough privilege to execute commands with DCOM(Distributed Component Object Model) protocol on the computer.

**Exec PWSH**: Indicates whether the local group can have enough privilege to execute commands with Powershell on the computer.

**Admin**: Indicates whether the local group can have admin privilege on the computer.

## Issues

Issues pane contains identified issues on the group object.

![Issues](/files/ZjcIzT2s5pupKWFrkgYy)