# LocalUser | Field | Type | Possible Operators | Description | | -------------------------- | ------- | ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Guid** | TEXT | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY` | A unique identifier that is a combination of GUID of selected `Scan` and random GUID. | | **FSName** | TEXT | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY` | A special unique identifier that is a combination of the `Name of the object` and the `FSName of the computer` that contains local user. | | **ObjectSid** | TEXT | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY` | Local security identifier of object. | | **Name** | TEXT | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY` | Name of the specified object. | | **IsEnabled** | BOOLEAN | `N/A` | Indicates whether the user is enabled. | | **HasNonExpiringPassword** | BOOLEAN | `N/A` | Indicates whether the object's password is set to never expire. | | **DontReqPasswd** | BOOLEAN | `N/A` | Indicates whether the object's password can be blank. | | **HasLocalService** | BOOLEAN | `N/A` | Indicates whether the object has managing local services (without SPN). | | **can\_rdp** | BOOLEAN | `N/A` | Indicates whether the local user can have enough privilege to connect with RDP (Remote Desktop Protocol) to the computer. | | **can\_exec\_pwsh** | BOOLEAN | `N/A` | Indicates whether the local user can have enough privilege to execute commands with Powershell on the computer. | | **admin\_to** | BOOLEAN | `N/A` | Indicates whether the local user can have admin privilege on the computer. | | **can\_exec\_dcom** | BOOLEAN | `N/A` | Indicates whether the local user can have enough privilege to execute commands with DCOM(Distributed Component Object Model) protocol on the computer. | | **inComputerName** | TEXT | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY` | FSName of the computer that contains the local user. | | **inLocalGroupName** | TEXT | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY` | FSName of the local group that contains the local user. | | **inComputerGuid** | TEXT | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY` | Guid of the computer that contains the local user. | | **IsPasswordExpired** | BOOLEAN | `N/A` | Indicates whether the object's password is expired and should be changed. | | **risk** | NUMBER | `EQUAL`, `BETWEEN`, `SMALLER`, `LARGER`, `SMALLER_EQUAL`, `LARGER_EQUAL` | The risk score of the object that calculated based on vulnerability counts and severities. | | **inLocalGroupGuid** | TEXT | `LIKE`,`NOT_LIKE EQUAL`,`NOT_EQUAL`,`IS_EMPTY` | Guid of the local group that contains the local user. | | **IsDomainUser** | BOOLEAN | `N/A` | That indicates **whether a user account belongs to a domain or is a local account**. | | **ExposurePoint** | NUMBER | `EQUAL`, `BETWEEN`, `SMALLER`, `LARGER`, `SMALLER_EQUAL`, `LARGER_EQUAL` | **ExposurePoint**: A numerical value indicating the level of risk or exposure. | --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.forestall.io/fsprotect/search-and-reports/localuser.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.