> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/active-directory-entities/localuser.md).

# LocalUser

| Field                  | Type    | Possible Operators                                             | Description                                                                                                                                            |
| ---------------------- | ------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Guid                   | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | A unique identifier that is a combination of GUID of selected `Scan` and random GUID.                                                                  |
| FSName                 | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | A special unique identifier that is a combination of the `Name of the object` and the `FSName of the computer` that contains local user.               |
| ObjectSid              | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Local security identifier of object.                                                                                                                   |
| Name                   | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Name of the specified object.                                                                                                                          |
| IsEnabled              | BOOLEAN | N/A (toggle)                                                   | Indicates whether the user is enabled.                                                                                                                 |
| HasNonExpiringPassword | BOOLEAN | N/A (toggle)                                                   | Indicates whether the object's password is set to never expire.                                                                                        |
| DontReqPasswd          | BOOLEAN | N/A (toggle)                                                   | Indicates whether the object's password can be blank.                                                                                                  |
| HasLocalService        | BOOLEAN | N/A (toggle)                                                   | Indicates whether the object has managing local services (without SPN).                                                                                |
| can\_rdp               | BOOLEAN | N/A (toggle)                                                   | Indicates whether the local user can have enough privilege to connect with RDP (Remote Desktop Protocol) to the computer.                              |
| can\_exec\_pwsh        | BOOLEAN | N/A (toggle)                                                   | Indicates whether the local user can have enough privilege to execute commands with Powershell on the computer.                                        |
| admin\_to              | BOOLEAN | N/A (toggle)                                                   | Indicates whether the local user can have admin privilege on the computer.                                                                             |
| can\_exec\_dcom        | BOOLEAN | N/A (toggle)                                                   | Indicates whether the local user can have enough privilege to execute commands with DCOM(Distributed Component Object Model) protocol on the computer. |
| inComputerName         | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | FSName of the computer that contains the local user.                                                                                                   |
| inLocalGroupName       | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | FSName of the local group that contains the local user.                                                                                                |
| inComputerGuid         | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Guid of the computer that contains the local user.                                                                                                     |
| IsPasswordExpired      | BOOLEAN | N/A (toggle)                                                   | Indicates whether the object's password is expired and should be changed.                                                                              |
| risk                   | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The risk score of the object that calculated based on vulnerability counts and severities.                                                             |
| inLocalGroupGuid       | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Guid of the local group that contains the local user.                                                                                                  |
| IsDomainUser           | BOOLEAN | N/A (toggle)                                                   | That indicates **whether a user account belongs to a domain or is a local account**.                                                                   |
| ExposurePoint          | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | **ExposurePoint**: A numerical value indicating the level of risk or exposure.                                                                         |
| Tier                   | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Tier level Forestall assigned to the object: `0` (Tier 0), `1` (Tier 1) or `2` (Tier 2). Lower is more privileged.                                     |