# GPO

| Field                               | Type    | Possible Operators                                                       | Description                                                                                                                                                                                    |
| ----------------------------------- | ------- | ------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Guid**                            | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | A unique identifier that is a combination of GUID of selected `Scan` and Active Directory `ObjectGUID` of the object.                                                                          |
| **FSName**                          | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | A special unique identifier that is a combination of the `Display Name of the object` and the `Fully Qualified Domain Name of the Domain`.                                                     |
| **Name**                            | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | Name of the specified object. (**Ldap Display Name**: name)                                                                                                                                    |
| **DistinguishedName**               | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | Active Directory distinguished name of the object. (**Ldap Display Name**: distinguishedName)                                                                                                  |
| **PolicyRules**                     | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | Contains group policy object settings in XML format.                                                                                                                                           |
| **Flags**                           | NUMBER  | `EQUAL`, `BETWEEN`, `SMALLER`, `LARGER`, `SMALLER_EQUAL`, `LARGER_EQUAL` | Indicates the state of the GPO. (**Ldap Display Name**: flags) ([Field Reference](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpod/d360d288-d7d5-49a9-83be-603805da1379)) |
| **Cn**                              | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | The name that represents an object. Used to perform searches. (**Ldap Display Name**: cn)                                                                                                      |
| **Passwords**                       | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | Plain-text passwords in Group Policy related configuration files.                                                                                                                              |
| **unrolled\_linked\_entity\_count** | NUMBER  | `EQUAL`, `BETWEEN`, `SMALLER`, `LARGER`, `SMALLER_EQUAL`, `LARGER_EQUAL` | The total number of objects that are affected by the group policy.                                                                                                                             |
| **WhenChanged**                     | DATE    | `SMALLER`, `LARGER`, `BETWEEN`, `EQUAL`                                  | The date when this object was last changed. (**Ldap Display Name**: whenChanged)                                                                                                               |
| **GPCFileSysPath**                  | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | SYSVOL Policy folder path of the group policy object. (**Ldap Display Name**: gPCFileSysPath)                                                                                                  |
| **DisplayName**                     | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | Indicates the friendly name of the GPO specified by the Group Policy administrator. (**LDAP Display Name**: displayName)                                                                       |
| **WhenCreated**                     | DATE    | `SMALLER`, `LARGER`, `BETWEEN`, `EQUAL`                                  | The date when this object was created. (**Ldap Display Name**: whenCreated)                                                                                                                    |
| **VersionNumber**                   | NUMBER  | `EQUAL`, `BETWEEN`, `SMALLER`, `LARGER`, `SMALLER_EQUAL`, `LARGER_EQUAL` | A general purpose version number. (**Ldap Display Name**: versionNumber)                                                                                                                       |
| **GPCFunctionalityVersion**         | NUMBER  | `EQUAL`, `BETWEEN`, `SMALLER`, `LARGER`, `SMALLER_EQUAL`, `LARGER_EQUAL` | The version of the Group Policy Editor that created this object. (**Ldap Display Name**: gPCFunctionalityVersion)                                                                              |
| **risk**                            | NUMBER  | `EQUAL`, `BETWEEN`, `SMALLER`, `LARGER`, `SMALLER_EQUAL`, `LARGER_EQUAL` | The risk score of the object that calculated based on vulnerability counts and severities.                                                                                                     |
| **GPCMachineExtensionNames**        | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | lists the GUIDs of client-side extensions (CSEs) linked to a Group Policy Object (GPO) that apply machine-level settings                                                                       |
| **IsCriticalSystemObject**          | BOOLEAN | `N/A`                                                                    | N/A                                                                                                                                                                                            |
| **IsEmpty**                         | BOOLEAN | `N/A`                                                                    | Indicates whether the Group Policy Object (GPO) contains any policy rules; it is `true` if `PolicyRules` is null or empty, meaning the GPO has no defined policies.                            |
| **ObjectClass**                     | TEXT    | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY`                           | It tells **what kind of object** the entry is, and more importantly, **what set of attributes** that object can or must have.                                                                  |
| **ExposurePoint**                   | NUMBER  | `EQUAL`, `BETWEEN`, `SMALLER`, `LARGER`, `SMALLER_EQUAL`, `LARGER_EQUAL` | **ExposurePoint**: A numerical value indicating the level of risk or exposure.                                                                                                                 |


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.forestall.io/fsprotect/search-and-reports/grouppolicyobject.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.