> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/search-and-reports/active-directory-entities/grouppolicyobject.md).

# GPO

| Field                               | Type    | Possible Operators                                                       | Description                                                                                                                                                                                    |
| ----------------------------------- | ------- | ------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Guid**                            | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | A unique identifier that is a combination of GUID of selected `Scan` and Active Directory `ObjectGUID` of the object.                                                                          |
| **FSName**                          | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | A special unique identifier that is a combination of the `Display Name of the object` and the `Fully Qualified Domain Name of the Domain`.                                                     |
| **Name**                            | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | Name of the specified object. (**Ldap Display Name**: name)                                                                                                                                    |
| **DistinguishedName**               | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | Active Directory distinguished name of the object. (**Ldap Display Name**: distinguishedName)                                                                                                  |
| **PolicyRules**                     | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | Contains group policy object settings in XML format.                                                                                                                                           |
| **Flags**                           | NUMBER  | `EQUAL`, `BETWEEN`, `SMALLER`, `LARGER`, `SMALLER_EQUAL`, `LARGER_EQUAL` | Indicates the state of the GPO. (**Ldap Display Name**: flags) ([Field Reference](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpod/d360d288-d7d5-49a9-83be-603805da1379)) |
| **Cn**                              | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | The name that represents an object. Used to perform searches. (**Ldap Display Name**: cn)                                                                                                      |
| **Passwords**                       | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | Plain-text passwords in Group Policy related configuration files.                                                                                                                              |
| **unrolled\_linked\_entity\_count** | NUMBER  | `EQUAL`, `BETWEEN`, `SMALLER`, `LARGER`, `SMALLER_EQUAL`, `LARGER_EQUAL` | The total number of objects that are affected by the group policy.                                                                                                                             |
| **WhenChanged**                     | DATE    | `SMALLER`, `LARGER`, `BETWEEN`, `EQUAL`                                  | The date when this object was last changed. (**Ldap Display Name**: whenChanged)                                                                                                               |
| **GPCFileSysPath**                  | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | SYSVOL Policy folder path of the group policy object. (**Ldap Display Name**: gPCFileSysPath)                                                                                                  |
| **DisplayName**                     | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | Indicates the friendly name of the GPO specified by the Group Policy administrator. (**LDAP Display Name**: displayName)                                                                       |
| **WhenCreated**                     | DATE    | `SMALLER`, `LARGER`, `BETWEEN`, `EQUAL`                                  | The date when this object was created. (**Ldap Display Name**: whenCreated)                                                                                                                    |
| **VersionNumber**                   | NUMBER  | `EQUAL`, `BETWEEN`, `SMALLER`, `LARGER`, `SMALLER_EQUAL`, `LARGER_EQUAL` | A general purpose version number. (**Ldap Display Name**: versionNumber)                                                                                                                       |
| **GPCFunctionalityVersion**         | NUMBER  | `EQUAL`, `BETWEEN`, `SMALLER`, `LARGER`, `SMALLER_EQUAL`, `LARGER_EQUAL` | The version of the Group Policy Editor that created this object. (**Ldap Display Name**: gPCFunctionalityVersion)                                                                              |
| **risk**                            | NUMBER  | `EQUAL`, `BETWEEN`, `SMALLER`, `LARGER`, `SMALLER_EQUAL`, `LARGER_EQUAL` | The risk score of the object that calculated based on vulnerability counts and severities.                                                                                                     |
| **GPCMachineExtensionNames**        | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | lists the GUIDs of client-side extensions (CSEs) linked to a Group Policy Object (GPO) that apply machine-level settings                                                                       |
| **IsCriticalSystemObject**          | BOOLEAN | `N/A`                                                                    | N/A                                                                                                                                                                                            |
| **IsEmpty**                         | BOOLEAN | `N/A`                                                                    | Indicates whether the Group Policy Object (GPO) contains any policy rules; it is `true` if `PolicyRules` is null or empty, meaning the GPO has no defined policies.                            |
| **ObjectClass**                     | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | It tells **what kind of object** the entry is, and more importantly, **what set of attributes** that object can or must have.                                                                  |
| **ExposurePoint**                   | NUMBER  | `EQUAL`, `BETWEEN`, `SMALLER`, `LARGER`, `SMALLER_EQUAL`, `LARGER_EQUAL` | **ExposurePoint**: A numerical value indicating the level of risk or exposure.                                                                                                                 |