# Groups

The `Groups` page provides a list of enumerated groups in entire Acitve Directory. The list contains the `Privileged`, `Admin`, `Local Admin`, `Member Count`, `Risk Score`,`Exposure Point` and `Issue Counts`.

<figure><img src="/files/jbwIpsgoj6ubVedqdt56" alt=""><figcaption><p>Groups</p></figcaption></figure>

## Group Details

Details page contains the `Risk Score` of the group,`Exposure Point`, `Information`, and `Issues` panes.

{% hint style="info" %}
You can analyze objects in the `Graph module` by clicking the `Visualize` button on the upper left side of the `Information Pane`.
{% endhint %}

<figure><img src="/files/Sg1PZnFIHhiUghf6R8Wx" alt=""><figcaption><p>Group Details</p></figcaption></figure>

## Information

`Information Pane` can contain different badges to highlight important attributes.

| Badge           | Description                                                                                                        |
| --------------- | ------------------------------------------------------------------------------------------------------------------ |
| **Privileged**  | Indicates that the object is Privileged.                                                                           |
| **Admin**       | Indicates that the object is Admin.                                                                                |
| **Local Admin** | Indicates that the object is a member (direct or nested) of a local administrators group in at least one computer. |

`Information Pane` contains `Details`, `Parent Groups`, `Child Groups`, `Child Users`, `Child Computers,Child MSAs` , `Child GMSAs` and `Local Memberships` tabs respectively.

## Details

Details tab contains attributes below about group object.

| Attribute              | Description                                                                                                                                                                                                   |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **SAM AccountName**    | The logon name used to support clients and servers running earlier versions of the operating system, such as Windows NT 4.0, Windows 95, Windows 98, and LAN Manager. (**Ldap Display Name**: sAMAccountName) |
| **Distinguished Name** | Active Directory distinguished name of the object. (**Ldap Display Name**: distinguishedName)                                                                                                                 |
| **Object Category**    | An object class name used to group objects of this or derived classes. (**Ldap Display Name**: objectCategory)                                                                                                |
| **Object Sid**         | Active Directory security identifier of object. (**Ldap Display Name**: objectSid)                                                                                                                            |
| **Parent OU**          | The direct parent Organizational Unit of the object.                                                                                                                                                          |
| **Name**               | Name of the specified object. (**Ldap Display Name**: name)                                                                                                                                                   |
| **Created Time**       | The date when this object was created. (**Ldap Display Name**: whenCreated)                                                                                                                                   |
| **Last Changed Time**  | The date when this object was last changed. (**Ldap Display Name**: whenChanged)                                                                                                                              |
| **Description**        | Description text to display for an object. (**Ldap Display Name**: description)                                                                                                                               |

## Parent Groups

Parent Groups tab contains a list of groups that the group is a member of. This list also contains `Privileged` and `Admin` columns to identify the privilege levels of these groups.

<figure><img src="/files/B2PKwMsX7CY2FlZT7uqB" alt=""><figcaption><p>Parent Groups</p></figcaption></figure>

## Child Groups

Child Groups tab contains a list of groups that are children of the group. This list also contains `Privileged` and `Admin` columns to identify the privilege levels of these groups.

<figure><img src="/files/PSUUmV7PPHzkkYKHpc1f" alt=""><figcaption><p>Child Groups</p></figcaption></figure>

## Child Users

The Child Users tab displays a list of user accounts associated with the group.

<figure><img src="/files/AouhtkU2EOSP2VBqX8mb" alt=""><figcaption><p>Child Users</p></figcaption></figure>

**Name**: The name of the user account.

**Privileged**: Indicates whether the user has elevated privileges.

**Admin**: Indicates whether the user has administrative rights.

**Enabled**: Indicates whether the user account is active.

## Child Computers

The Child Computers tab displays a list of computer objects associated with the group.

<figure><img src="/files/hZujFyUxK6M6njJxs02N" alt=""><figcaption><p>Child Computers</p></figcaption></figure>

**Name**: The name of the computer object.

**IP Address**: The IP address assigned to the computer.

**Privileged**: Indicates whether the computer object has elevated privileges.

**Admin**: Indicates whether the computer object has administrative rights.

**Enabled**: Indicates whether the computer object is enabled.

## Child MSAs

The Child MSAs tab displays a list of Managed Service Accounts (MSAs) associated with the group.

<figure><img src="/files/AFcZphZUAu8u7dxDEnTk" alt=""><figcaption><p>Child MSAs</p></figcaption></figure>

**Name**: The name of the Managed Service Account.

**Privileged**: Indicates whether the MSA has elevated privileges.

**Admin**: Indicates whether the MSA has administrative rights.

**Enabled**: Indicates whether the MSA is active.

## Child GMSAs

The Child GMSAs tab displays a list of Group Managed Service Accounts (GMSAs) associated with the group.

<figure><img src="/files/2u2X2G78dixevvAJXDzB" alt=""><figcaption><p>Child GMSAs</p></figcaption></figure>

**Name**: The name of the Group Managed Service Account.

**Privileged**: Indicates whether the GMSA has elevated privileges.

**Admin**: Indicates whether the GMSA has administrative rights.

**Enabled**: Indicates whether the GMSA is active.

## Child DMSAs

The Child DMSAs tab displays a list of Delegated Managed Service Accounts (DMSAs) associated with the group.

<figure><img src="/files/NflM3fwcv1V8EtRxGUT1" alt=""><figcaption><p>Child DMSAs</p></figcaption></figure>

**Name**: The name of the Delegated Managed Service Account.

**Privileged**: Indicates whether the DMSA has elevated privileges.

**Admin**: Indicates whether the DMSA has administrative rights.

**Enabled**: Indicates whether the DMSA is active.

## Local Memberships

Local Memberships tab contains a list of local groups that the group is a member of.

<figure><img src="/files/hLVhYX4xdG4KVZa1qdD2" alt=""><figcaption><p>Local Memberships</p></figcaption></figure>

**Local Group Name**: Name of the local group that the group is a member of.

**Computer**: Name of the computer object that contains the local group.

**Exec DCOM**: Indicates whether the local group can have enough privilege to execute commands with DCOM(Distributed Component Object Model) protocol on the computer.

**Exec PWSH**: Indicates whether the local group can have enough privilege to execute commands with Powershell on the computer.

**Admin**: Indicates whether the local group can have admin privilege on the computer.

## Issues

Issues pane contains identified issues on the group object.

![Issues](/files/ZjcIzT2s5pupKWFrkgYy)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.forestall.io/fsprotect/ad-identities/groups.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.