# Tier0

<table><thead><tr><th width="200">Field</th><th>Type</th><th width="184">Possible Operators</th><th>Description</th></tr></thead><tbody><tr><td><strong>Guid</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>A unique identifier that is a combination of GUID of selected <code>Scan</code> and Active Directory <code>ObjectGUID</code> of the object.</td></tr><tr><td><strong>FSName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>A special unique identifier that is a combination of the <code>Name of the object</code> and the <code>Fully Qualified Domain Name of the Domain</code>.</td></tr><tr><td><strong>ObjectSid</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Active Directory security identifier of object. (<strong>Ldap Display Name</strong>: objectSid)</td></tr><tr><td><strong>Name</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Name of the specified object. (<strong>Ldap Display Name</strong>: name)</td></tr><tr><td><strong>IsDomainController</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the machine is a Domain Controller server.</td></tr><tr><td><strong>OperatingSystem</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The name of the operating system that runs on the computer. (<strong>Ldap Display Name</strong>: operatingSystem)</td></tr><tr><td><strong>OperatingSystemVersion</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The version of the operating system that runs on the computer. (<strong>Ldap Display Name</strong>: operatingSystemVersion)</td></tr><tr><td><strong>IsEnabled</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the object is enabled.</td></tr><tr><td><strong>DistinguishedName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Active Directory distinguished name of the object. (<strong>Ldap Display Name</strong>: distinguishedName)</td></tr><tr><td><strong>session_count</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Indicates the number of sessions on the computer.</td></tr><tr><td><strong>explicit_localadmin_count</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Indicates the number of explicit local admins on the computer.</td></tr><tr><td><strong>IsPrivileged</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates that the object is Privileged.</td></tr><tr><td><strong>IsSMBv202Active</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the SMB Version 2.2 is active.</td></tr><tr><td><strong>IsUnsupported</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the computer runs an unsupported/obsolote operating system.</td></tr><tr><td><strong>IsAdmin</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates that the object is Admin.</td></tr><tr><td><strong>DNSHostName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Fully qualified domain name of computer as registered in DNS. (<strong>Ldap Display Name</strong>: dNSHostName)</td></tr><tr><td><strong>IsSpoolActive</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the Spool service is running on the computer.</td></tr><tr><td><strong>WhenChanged</strong></td><td>DATE</td><td><code>SMALLER</code>, <code>LARGER</code>, <code>BETWEEN</code>, <code>EQUAL</code></td><td>The date when this object was last changed. (<strong>Ldap Display Name</strong>: whenChanged)</td></tr><tr><td><strong>IsProtected</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates that the object is a direct or nested member of the Protected Users group.</td></tr><tr><td><strong>WhenCreated</strong></td><td>DATE</td><td><code>SMALLER</code>, <code>LARGER</code>, <code>BETWEEN</code>, <code>EQUAL</code></td><td>The date when this object was created. (<strong>Ldap Display Name</strong>: whenCreated)</td></tr><tr><td><strong>MsDSSupportedEncryptionTypes</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The encryption algorithms supported by user, computer or trust accounts. The KDC uses this information while generating a service ticket for this account. Services and Computers can automatically update this attribute on their respective accounts in Active Directory, and therefore need write access to this attribute. (<strong>LDAP Display Name</strong>: msDS-SupportedEncryptionTypes)</td></tr><tr><td><strong>IsSMBv2v3SignEnabled</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the SMB Version 2 and Version 3 protocol signing is enabled.</td></tr><tr><td><strong>HasLaps</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the local administrator account on the computer is managed through LAPS(Local Administrator Password Solution).</td></tr><tr><td><strong>IPAddress</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>IPV4 Network address of the computer.</td></tr><tr><td><strong>risk</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The risk score of the object that calculated based on vulnerability counts and severities.</td></tr><tr><td><strong>UserAccountControl</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Flags that control different attributes and behavior of the objects. (<strong>Ldap Display Name</strong>: userAccountControl) (<a href="https://learn.microsoft.com/en-us/windows/win32/adschema/a-useraccountcontrol">Field Reference</a>)</td></tr><tr><td><strong>AllowedtoDelegateSpn</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Contains Service Principal Name definitions in the context of Constrained Delegation. (<strong>LDAP Display Name</strong>: msDS-AllowedToDelegateTo)</td></tr><tr><td><strong>SAMAccountName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The logon name used to support clients and servers running earlier versions of the operating system, such as Windows NT 4.0, Windows 95, Windows 98, and LAN Manager. (<strong>Ldap Display Name</strong>: sAMAccountName)</td></tr><tr><td><strong>DontReqPasswd</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the object's password can be blank.</td></tr><tr><td><strong>DontReqPreauth</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the Kerberos Pre-Authentication mechanism was disabled for the object.</td></tr><tr><td><strong>Cn</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The name that represents an object. Used to perform searches. (<strong>Ldap Display Name</strong>: cn)</td></tr><tr><td><strong>IsSMBv2v3SignRequired</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the SMB Version 2 and Version 3 protocol requires signing.</td></tr><tr><td><strong>HasReversibleEncryption</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the object is using reversible encryption instead of hash to keep credentials.</td></tr><tr><td><strong>IsSMBv210Active</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the SMB Version 2.10 is active.</td></tr><tr><td><strong>SidHistory</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Contains previous SIDs used for the object if the object was moved from another domain. Whenever an object is moved from one domain to another, a new SID is created and that new SID becomes the objectSID. The previous SID is added to the sIDHistory property. (<strong>Ldap Display Name</strong>: sIDHistory)</td></tr><tr><td><strong>IsSMBv1Active</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the SMB Version 1 is active.</td></tr><tr><td><strong>PwdLastSet</strong></td><td>DATE</td><td><code>SMALLER</code>, <code>LARGER</code>, <code>BETWEEN</code>, <code>EQUAL</code></td><td>The date and time that the password for this account was last changed. If this value is set to 0 and the User-Account-Control attribute does not contain the UF_DONT_EXPIRE_PASSWD flag, then the user must set the password at the next logon. (<strong>Ldap Display Name</strong>: pwdLastSet)</td></tr><tr><td><strong>IsUsingDESAlgorithmForHashing</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the object is using an insecure DES algorithm in Kerberos protocol.</td></tr><tr><td><strong>AdminCount</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Indicates that a given object has had its ACLs changed to a more secure value by the system because it was a member of one of the administrative groups (directly or transitively). (<strong>Ldap Display Name</strong>: adminCount)</td></tr><tr><td><strong>LapsExpirationTime</strong></td><td>DATE</td><td><code>SMALLER</code>, <code>LARGER</code>, <code>BETWEEN</code>, <code>EQUAL</code></td><td>Stores the password expiration time of LAPS. (<strong>Ldap Display Name</strong>: ms-Mcs-AdmPwdExpirationTime)</td></tr><tr><td><strong>LastLogon</strong></td><td>DATE</td><td><code>SMALLER</code>, <code>LARGER</code>, <code>BETWEEN</code>, <code>EQUAL</code></td><td>The last time the user logged on. This attribute is not replicated to other Domain Controllers. (<strong>Ldap Display Name</strong>: lastLogon)</td></tr><tr><td><strong>HasUnconstrainedDelegation</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the Unconstrained Delegation is activated on the object.</td></tr><tr><td><strong>IsSMBPortOpen</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether port 445 of the computer is accessible.</td></tr><tr><td><strong>LogonCount</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The number of times the account has successfully logged on. This attribute is not replicated to other Domain Controllers. (<strong>Ldap Display Name</strong>: logonCount)</td></tr><tr><td><strong>IsSMBv311Active</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the SMB Version 3.1 is active.</td></tr><tr><td><strong>BadPwdCount</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The number of times the object tried to log on to the account using an incorrect password. (<strong>Ldap Display Name</strong>: badPwdCount)</td></tr><tr><td><strong>HasConstrainedDelegation</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the Constrained Delegation is activated on the object.</td></tr><tr><td><strong>IsStealth</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates that the object can compromise admin objects with at least one attack path.</td></tr><tr><td><strong>HasResourceBasedConstrainedDelegation</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the Resource Based Constrained Delegation is activated on the object.</td></tr><tr><td><strong>IsSMBv300Active</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the SMB Version 3 is active.</td></tr><tr><td><strong>group_delegated_localadmin_count</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Indicates that the object has group delegated local admin privilege on how many computers.</td></tr><tr><td><strong>PrimaryGroupID</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Contains the relative identifier (RID) for the primary group of the object. (<strong>Ldap Display Name</strong>: primaryGroupID)</td></tr><tr><td><strong>IsSMBv302Active</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the SMB Version 3.2 is active.</td></tr><tr><td><strong>LastLogonTimestamp</strong></td><td>DATE</td><td><code>SMALLER</code>, <code>LARGER</code>, <code>BETWEEN</code>, <code>EQUAL</code></td><td>The time that the user last logged into the domain. This attribute is replicated to other Domain Controllers but not updated until after 14 (msDS-LogonTimeSyncInterval) days. (<strong>Ldap Display Name</strong>: lastLogonTimestamp)</td></tr><tr><td><strong>SAMAccountType</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Specifies the account type of the security principal objects in Active Directory. (<strong>LDAP Display Name</strong>: sAMAccountType) (<a href="https://learn.microsoft.com/en-us/windows/win32/adschema/a-samaccounttype">Field Reference</a>)</td></tr><tr><td><strong>IsLocalAdmin</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates that the object is a member (direct or nested) of a local administrators group in at least one computer.</td></tr><tr><td><strong>HasProtocolTransition</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the Constrained Delegation with Protocol transition is activated on the object.</td></tr><tr><td><strong>IsSMBv1SignRequired</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the SMB Version 1 protocol requires signing.</td></tr><tr><td><strong>DisplayName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The display name for an object. This is usually the combination of the users first name, middle initial, and last name. (<strong>LDAP Display Name:</strong> displayName)</td></tr><tr><td><strong>IsServiceUser</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the object is managing services through Service Principal Name.</td></tr><tr><td><strong>IsWindowsOS</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Determines whether the current operating system is a version of Microsoft Windows. It returns <strong>true</strong> if the OS is Windows, otherwise <strong>false</strong>.</td></tr><tr><td><strong>IsWindowsServer</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Checks if the operating system is a Windows Server edition. It returns <strong>true</strong> if the OS is a Windows Server, otherwise <strong>false</strong>.</td></tr><tr><td><strong>IsWSUServer</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Checks if the machine is configured as a Windows Server Update Services (WSUS) server. Returns <strong>true</strong> if it is a WSUS server, otherwise <strong>false</strong>.</td></tr><tr><td><strong>HTTPUpdateService</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Handles application updates by communicating with a remote server over HTTP. It fetches version information, compares it with the application's current version, and initiates the update process if necessary.</td></tr><tr><td><strong>IsInactive</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether a computer has been enabled but unused (no logon) for a period longer than the defined inactivity threshold</td></tr><tr><td><strong>member_count</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The total count of the direct member objects.</td></tr><tr><td><strong>IsAccountLocked</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the account password was locked due to multiple incorrect password attempts.</td></tr><tr><td><strong>IsDomainController</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the machine is a Domain Controller server.</td></tr><tr><td><strong>ServicePrincipalName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>These SPN entries indicate that the computer has Kerberos service identifiers registered for both its hostname and fully qualified domain name under the HOST and RestrictedKrbHost service classes, allowing it to securely participate in Kerberos authentication.</td></tr><tr><td><strong>MsDsCreatorSid</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>security identifier (SID) of the account that originally created the Active Directory object, retrieved in binary form and converted to a readable SID string.</td></tr><tr><td><strong>Description</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Description text to display for an object. (<strong>Ldap Display Name</strong>: description)</td></tr><tr><td><strong>SmbShares</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Shared folders or printers on a network using the <strong>SMB (Server Message Block)</strong> protocol for file and resource sharing.</td></tr><tr><td><strong>ExposurePoint</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td><strong>ExposurePoint</strong>: A numerical value indicating the level of risk or exposure.</td></tr><tr><td><strong>InfrastructureRoleOwner</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Domain controller that holds the infrastructure owner role.</td></tr><tr><td><strong>RidRoleOwner</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Domain controller that holds the relative identifier (RID) master role for this domain.</td></tr><tr><td><strong>FSMORoleOwner</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Flexible Single-Master Operation: The distinguished name of the DC where the schema can be modified. (<strong>Ldap Display Name</strong>: fSMORoleOwner)</td></tr><tr><td><strong>IsRootDomain</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the domain is the root of the forest.</td></tr><tr><td><strong>IsRecycleBinEnabled</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the recycle bin is activated for the domain.</td></tr><tr><td><strong>PwdProperties</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>A bitfield to indicate complexity and storage restrictions. (<strong>Ldap Display Name</strong>: pwdProperties) (<a href="https://learn.microsoft.com/en-us/windows/win32/adschema/a-pwdproperties">Field Reference</a>)</td></tr><tr><td><strong>IsEnumerable</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates the FSProtect enumeration status of the domain.</td></tr><tr><td><strong>PdcRoleOwner</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Domain controller that holds the primary domain controller (PDC) for this domain.</td></tr><tr><td><strong>DomainMode</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The operating mode of the domain. (<a href="https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.activedirectory.domainmode?view=windowsdesktop-7.0">Field reference</a>)</td></tr><tr><td><strong>LockoutThreshold</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The number of invalid logon attempts that are permitted before the account is locked out. (<strong>Ldap Display Name</strong>: lockoutThreshold)</td></tr><tr><td><strong>PwdHistoryLength</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The number of old passwords to save. (<strong>Ldap Display Name</strong>: pwdHistoryLength)</td></tr><tr><td><strong>DomainModeLevel</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The operating mode level of the domain. (<a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/6dd88965-8feb-4369-ae7e-075985da8071">Field Reference</a>)</td></tr><tr><td><strong>NetbiosName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The name of the object to be used over NetBIOS. (<strong>Ldap Display Name</strong>: nETBIOSName)</td></tr><tr><td><strong>MinPwdLength</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The minimum number of characters that a password must contain. (<strong>Ldap Display Name</strong>: minPwdLength)</td></tr><tr><td><strong>MsDSMachineAccountQuota</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The number of computer accounts that a user is allowed to create in a domain. (<strong>Ldap Display Name</strong>: ms-DS-MachineAccountQuota)</td></tr><tr><td><strong>msDSMaximumPasswordAge</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Defines the maximum number of days a user password remains valid before it must be changed.</td></tr><tr><td><strong>msDSPasswordSettingsPrecedence</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Specifies the precedence of the password policy. Lower numbers have higher priority.</td></tr><tr><td><strong>msDSPasswordReversibleEncryptionEnabled</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Specifies whether reversible encryption is enabled for user passwords.</td></tr><tr><td><strong>MinimumPassAge</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Specifies the minimum number of days a user must wait before changing their password again.</td></tr><tr><td><strong>msDSPasswordComplexityEnabled</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>The status of password complexity requirements for user accounts.</td></tr><tr><td><strong>msDSLockoutObservationWindow</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Specifies the time window (in minutes) during which failed logon attempts are counted before account lockout.</td></tr><tr><td><strong>msDSPasswordHistoryLength</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Specifies the number of previous passwords remembered to prevent reuse by the user.</td></tr><tr><td><strong>msDSLockoutThreshold</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Specifies the number of failed logon attempts allowed before the user account is locked out.</td></tr><tr><td><strong>msDSLockoutDuration</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Specifies the duration (in minutes) that a user account remains locked after reaching the lockout threshold.</td></tr><tr><td><strong>msDSMinimumPasswordLength</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Specifies the minimum number of characters required in a user password.</td></tr><tr><td><strong>IsWeak</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Shows whether the password policy settings are considered insecure, based on factors like short passwords, lack of complexity, absence of account lockout, or reversible encryption.</td></tr><tr><td><strong>GPCFunctionalityVersion</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The version of the Group Policy Editor that created this object. (<strong>Ldap Display Name</strong>: gPCFunctionalityVersion)</td></tr><tr><td><strong>Flags</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Indicates the state of the GPO. (<strong>Ldap Display Name</strong>: flags) (<a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpod/d360d288-d7d5-49a9-83be-603805da1379">Field Reference</a>)</td></tr><tr><td><strong>GPCMachineExtensionNames</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>lists the GUIDs of client-side extensions (CSEs) linked to a Group Policy Object (GPO) that apply machine-level settings.</td></tr><tr><td><strong>unrolled_linked_entity_count</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The total number of objects that are affected by the group policy.</td></tr><tr><td><strong>PolicyRules</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Contains group policy object settings in XML format.</td></tr><tr><td><strong>VersionNumber</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>A general purpose version number. (<strong>Ldap Display Name</strong>: versionNumber)</td></tr><tr><td><strong>GPCFileSysPath</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>SYSVOL Policy folder path of the group policy object. (<strong>Ldap Display Name</strong>: gPCFileSysPath)</td></tr><tr><td><strong>IsCriticalSystemObject</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>N/A</td></tr><tr><td><strong>IsEmpty</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the Group Policy Object (GPO) contains any policy rules; it is <code>true</code> if <code>PolicyRules</code> is null or empty, meaning the GPO has no defined policies.</td></tr><tr><td><strong>Passwords</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Plain-text passwords in Group Policy related configuration files.</td></tr><tr><td><strong>ObjectClass</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>It tells <strong>what kind of object</strong> the entry is, and more importantly, <strong>what set of attributes</strong> that object can or must have.</td></tr><tr><td><strong>GroupType</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Contains a set of flags that define the type and scope of a group object. (<strong>Ldap Display Name</strong>: https://learn.microsoft.com/en-us/windows/win32/adschema/a-grouptype)</td></tr><tr><td><strong>first_degree_localadmin_count</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Indicates that the account has explicit local admin privilege on how many computers.</td></tr><tr><td><strong>PasswordExpirationDate</strong></td><td>DATE</td><td><code>SMALLER</code>, <code>LARGER</code>, <code>BETWEEN</code>, <code>EQUAL</code></td><td>The expiration date of the object's password.</td></tr><tr><td><strong>HasNonExpiringPassword</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the object's password is set to never expire.</td></tr><tr><td><strong>MsDSManagedPasswordInterval</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>This attribute is used to retrieve the number of days before a managed password is automatically changed for a group MSA. (<strong>Ldap Display Name</strong>: msDS-ManagedPasswordInterval)</td></tr><tr><td><strong>HasLocalService</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the object has managing local services (without SPN).</td></tr><tr><td><strong>IsSensetive</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the object's NOT_DELEGATED bit of UserAccountControl is set. This attribute is used to disable Kerberos delegations for objects.</td></tr><tr><td><strong>IsPasswordExpired</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the object's password is expired and should be changed.</td></tr><tr><td><strong>IsDomainGroup</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the group is a Domain Group (true) defined in Active Directory or a Local Group (false) defined only on the local machine.</td></tr><tr><td><strong>can_rdp</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the local user can have enough privilege to connect with RDP (Remote Desktop Protocol) to the computer.</td></tr><tr><td><strong>can_exec_pwsh</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the local user can have enough privilege to execute commands with Powershell on the computer.</td></tr><tr><td><strong>admin_to</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the local user can have admin privilege on the computer.</td></tr><tr><td><strong>can_exec_dcom</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the local user can have enough privilege to execute commands with DCOM(Distributed Component Object Model) protocol on the computer.</td></tr><tr><td><strong>inComputerName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>FSName of the computer that contains the local user.</td></tr><tr><td><strong>inComputerGuid</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Guid of the computer that contains the local user.</td></tr><tr><td><strong>IsDomainUser</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>That indicates <strong>whether a user account belongs to a domain or is a local account</strong>.</td></tr><tr><td><strong>inLocalGroupName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>FSName of the local group that contains the local user.</td></tr><tr><td><strong>inLocalGroupGuid</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Guid of the local group that contains the local user.</td></tr><tr><td><strong>BlockInheritance</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the OU blocks Group Policy inheritance. (<strong>Ldap Display Name</strong>: gPOptions)</td></tr><tr><td><strong>Host</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Fully qualified domain name or NetBIOS name of the computer that the service running on.</td></tr><tr><td><strong>Port</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Port number of the service.</td></tr><tr><td><strong>ServiceName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Specifies the unique identifier or instance name of the service within the SPN, distinguishing it from other similar service instances.</td></tr><tr><td><strong>FullName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Combination of the DNSHostName and the Name of the certificate authority.</td></tr><tr><td><strong>ServiceClass</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Name of the service.</td></tr><tr><td><strong>UserPrincipalName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Internet-style unique login name for a user based on the Internet standard RFC 822. A UPN consists of a UPN prefix (the user account name) and a UPN suffix (a DNS domain name). (<strong>Ldap Display Name</strong>: userPrincipalName)</td></tr><tr><td><strong>IsTrustAccount</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the object is used to manage the related trust.</td></tr><tr><td><strong>GivenName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Contains the given name (first name) of the user. (<strong>Ldap Display Name</strong>: givenName)</td></tr><tr><td><strong>Sn</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>This attribute contains the family or last name for a user. (<strong>LDAP Display Name</strong>: Sn)</td></tr><tr><td><strong>AllowsUserSpecifiedSANs</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Whether specifying a Subject Alternative Name (SAN) during certificate enrollment to any certificate template that is published by this certificate authority server has been allowed.</td></tr><tr><td><strong>CertificateManagerRestrictions</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Some organizations require further restrictions on certificate manager activities. Rather than allow a certificate manager to issue or revoke any certificate issued by a CA, the organization might want a certificate manager to only manage a subset of all certificates. Specified property contains the defined certificate manager restrictions on the certificate authority. The data in this column formatted as, <code>Name of the Certificate Manager</code>,<code>Name of the Template</code> ,<code>Name of the Principal</code>,<code>Access Type</code>. The definition is, <code>Name of the Certificate Manager</code> has <code>Access Type</code> rights on <code>Name of the Principal</code> to manage the <code>Name of the Template</code> template.</td></tr><tr><td><strong>isEnterpriseCa</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Whether the certificate authority is an enterprise certificate authority instance. Enterprise certificate authorities are domain members and typically online to issue certificates or certificate policies.</td></tr><tr><td><strong>EnterpriseCAName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Name of the CA server, specified in the ADCS installation.</td></tr><tr><td><strong>CaCertificateDN</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Full distinguished name from the CA certificate.</td></tr><tr><td><strong>IsWebEnrollmentEnabled</strong></td><td>BOOLEAN</td><td>N/A</td><td>Whether the certificate authority server supports web-based enrollment for the clients.</td></tr><tr><td><strong>CAEnrollmentInterfacesHTTPEnabled</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The Web-based endpoints of the certificate authority with HTTP enabled.</td></tr><tr><td><strong>CAFlags</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The certificate authority flags attribute stores the bitwise combination of the certificate authority server's capabilities.</td></tr><tr><td><strong>NetworkDeviceEnrollmentServiceUrls</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Network device enrollment url addresses of the certificate authority.</td></tr><tr><td><strong>CAWebEnrollmentUrls</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Certificate authority web enrollment url addresses of the certificate authority.</td></tr><tr><td><strong>CertificateEnrollmentPolicyWebServiceUrls</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Certificate enrollment policy web service url addresses of the certificate authority.</td></tr><tr><td><strong>CertificateEnrollmentWebServiceUrls</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Certificate enrollment web service url addresses of the certificate authority.</td></tr><tr><td><strong>isRootCA</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Whether the certificate authority is an root certificate authority instance. The root certificate authorities are the first and may be the only certificate authorities configured in a Public Key Infrastructure(PKI) hierarchy.</td></tr><tr><td><strong>CAEnrollmentInterfacesEPADisabled</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The Web-based endpoints of the certificate authority with Extended Authentication Protection (EPA) disabled.</td></tr><tr><td><strong>EnrollmentAgentRestrictions</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>An enrollment agent is a user who can enroll for a certificate on behalf on another client. Unlike a certificate manager, an enrollment agent can only process the enrollment request and cannot approve pending requests or revoke issued certificates. Some organizations require further restrictions on enrollment agents. Rather than allow a certificate request agent to to enroll on behalf any client issued by a CA, the organization might want a certificate request agent to only enroll on behalf of a subset of all certificate templates or clients. Specified property contains the defined certificate request agent restrictions on the certificate authority. The data in this column formatted as, <code>Name of the Enrollment Agent</code>,<code>Name of the Template</code> ,<code>Name of the Principal</code>,<code>Access</code>. The definition is, <code>Name of the Enrollment Agent</code> has <code>Access Type</code> rights to enroll on behalf of <code>Name of the Principal</code> to the <code>Name of the Template</code> certificate template.</td></tr><tr><td><strong>isEnrollmentCertificate</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Whether the CA certificate can process certificate requests and issue certificates.</td></tr><tr><td><strong>Version</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>Version of the certificate.</td></tr><tr><td><strong>SubjectName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The subject name of the CA certificate.</td></tr><tr><td><strong>Certchain</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The list of certificates that start from a server's certificate and terminate with the root certificate</td></tr><tr><td><strong>EndDate</strong></td><td>DATE</td><td><code>SMALLER</code>, <code>LARGER</code>, <code>BETWEEN</code>, <code>EQUAL</code></td><td>Expiry date of the CA certificate.</td></tr><tr><td><strong>StartDate</strong></td><td>DATE</td><td><code>SMALLER</code>, <code>LARGER</code>, <code>BETWEEN</code>, <code>EQUAL</code></td><td>Issue date of the CA certificate.</td></tr><tr><td><strong>isRootCertificate</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Whether the CA certificate belongs to a root CA.</td></tr><tr><td><strong>Serial</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>A number that uniquely identifies the certificate and is issued by the certification authority.</td></tr><tr><td><strong>SignatureAlgorithm</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The algorithm used to create the signature of a certificate.</td></tr><tr><td><strong>KeyUsage</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Key usage extensions define the purpose of the public key contained in a certificate. You can use them to restrict the public key to as few or as many operations as needed.</td></tr><tr><td><strong>Thumbprint</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The hash value computed over the complete certificate, which includes all its fields, including the signature.</td></tr><tr><td><strong>IsInNTAuthStore</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Whether the CA certificate in the <code>NTAuthCertificates</code> container. This object defines one or more CA certificates in its <code>cacertificate</code> attribute and AD uses it during authentication. The domain controller checks if <code>NTAuthCertificates</code> object contains an entry for the CA specified in the authenticating certificate's Issuer field. If it is, authentication proceeds. If the certificate is not in the <code>NTAuthCertificates</code> object, authentication fails.</td></tr><tr><td><strong>IssuerName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The name of the certificate issuer.</td></tr><tr><td><strong>SchemaVersion</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The certificate template schema version.</td></tr><tr><td><strong>IsEnrolleeSuppliesSubject</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Whether specifying a Subject Alternative Name (SAN) during certificate enrollment to this certificate template has been allowed.</td></tr><tr><td><strong>ValidityPeriod</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The period of time during which a certificate is intended to be valid.</td></tr><tr><td><strong>MSPKICertificateApplicationPolicies</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Specifies certificate application policy extension. In GUI, this attribute can be controlled by setting "Application Policies" in "Extensions" tab. (<a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/44012f2d-5ef3-440d-a61b-b30d3d978130">Field Reference</a>)</td></tr><tr><td><strong>IsManagerApprovalEnabled</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Whether the certificate requests based on the template require manager approval to be issued.</td></tr><tr><td><strong>IsPublished</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Whether the certificate template has been published by any certificate authority.</td></tr><tr><td><strong>NumberOfAuthorizedSignatures</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The number of Authorized Signatures to issue a certificate.</td></tr><tr><td><strong>ExtendedKeyUsage</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Key usage extensions define the purpose of the public key contained in a certificate. You can use them to restrict the public key to as few or as many operations as needed.</td></tr><tr><td><strong>MSPKIRAPolicies</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Contains the list of required policy OIDs from registration authorities who sign the enrollment request. (<a href="https://learn.microsoft.com/en-us/windows/win32/adschema/a-mspki-ra-policies">Field Reference</a>)</td></tr><tr><td><strong>HasDomainAuthenticationEKU</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Whether certificate template contains any Extended Key Usage(EKU) that allows to auhenticate in the domain.</td></tr><tr><td><strong>MSPKIRAApplicationPolicies</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Encapsulates embedded properties for multipurpose use. In GUI, this attribute can be controlled by checking <code>This number of authorized signatures</code> check box in <code>Issuance Requirements</code> tab and choosing <code>Application Policy</code> menu. (<a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/3fe798de-6252-4350-aace-f418603ddeda">Field Reference</a>)</td></tr><tr><td><strong>EnrollmentFlags</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Specifies the enrollment flags. (<a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/ec71fd43-61c2-407b-83c9-b52272dec8a1">Field Reference</a>)</td></tr><tr><td><strong>CertificateNameFlags</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Specifies the subject name flags. (<a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/1192823c-d839-4bc3-9b6b-fa8c53507ae1">Field Reference</a>)</td></tr><tr><td><strong>RenewalPeriod</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The period of time during which a certificate is intended to be renew.</td></tr><tr><td><strong>Severity</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>A special unique identifier that is a combination of the <code>Name of the Organizational Unit</code> and the <code>Fully Qualified Domain Name of the Domain</code></td></tr><tr><td><strong>Tags</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Labels attached to issues to categorize, group, and make it easy to understand.</td></tr><tr><td><strong>Impact</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The special tag attached to issues to identify the effects of issues on Active Directory.</td></tr><tr><td><strong>EaseOfDetection</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Indicates the level of effort to detect exploitation of the issues. Ease of Detection can be Easy, Medium, or High.</td></tr><tr><td><strong>EaseOfMİtigation</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Indicates the level of effort to mitigate/remediate the issues. Ease of Mitigation can be Easy, Medium, or High.</td></tr><tr><td><strong>EaseOfDecepetion</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Indicates the level of effort of implementing deceptive countermeasures based on issues. Ease of Detection can be Easy, Medium, or High.</td></tr><tr><td><strong>FsprotectImpactName</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Refers to the specific impact classification or identifier assigned to a vulnerability within the FSProtect framework, defining the potential effect or severity associated with that vulnerability.</td></tr><tr><td><strong>AttackTactic</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Specific tactical category derived from the MITRE ATT&#x26;CK® framework. It classifies the behavior, strategy, or stage of cyber threats within security analysis or incident response systems. Tactics help analysts identify attackers' objectives and better understand threat activities.</td></tr><tr><td><strong>ForestMode</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The operating mode of the forest. (<a href="https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.activedirectory.forestmode?view=windowsdesktop-7.0">Field reference</a>)</td></tr><tr><td><strong>ForestModeLevel</strong></td><td>NUMBER</td><td><code>EQUAL</code>, <code>BETWEEN</code>, <code>SMALLER</code>, <code>LARGER</code>, <code>SMALLER_EQUAL</code>, <code>LARGER_EQUAL</code></td><td>The operating mode level of the forest. (<a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/d49624d0-9320-4368-8b0c-a7998ac2abdb">Field reference</a>)</td></tr><tr><td><strong>Schema</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Distinguished Name of the Schema of the forest.</td></tr><tr><td><strong>SchemaRoleOwner</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Domain controller that holds the FSMO schema master role for the forest.</td></tr><tr><td><strong>NamingRoleOwner</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Domain controller that holds the FSMO naming master role for the forest.</td></tr><tr><td><strong>RootDomain</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The Root Domain is the first domain created in a forest and acts as the central point for trust and namespace structure.</td></tr><tr><td><strong>Path</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The full location where the script file was found during the scan.</td></tr><tr><td><strong>GpoType</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Indicates the group policy type the script belongs to. (Machine, User)</td></tr><tr><td><strong>IsRead</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the file is readable by Everyone.</td></tr><tr><td><strong>CommandLine</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>The CommandLine property defines the full command line used to run the script, including the script’s file path and parameters. It is read from the GPO configuration files (scripts.ini or psscripts.ini), which store the script settings for Startup, Shutdown, Logon, and Logoff processes.</td></tr><tr><td><strong>Parameters</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Indicates the command line parameters that are required to run the script.</td></tr><tr><td><strong>CanEveryoneWrite</strong></td><td>BOOLEAN</td><td><code>N/A</code></td><td>Indicates whether the file is writable by Everyone.</td></tr><tr><td><strong>EntityType</strong></td><td>TEXT</td><td><code>LIKE</code>,<code>NOT_LIKE EQUAL</code>,<code>NOT_EQUAL</code>,<code>IS_EMPTY</code></td><td>Entity types represent distinct objects within the Active Directory environment, such as Domains, Users, and Group Policy Objects (GPOs).</td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.forestall.io/fsprotect/search-and-reports/tier0.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.