To view a Tier Zero object's details:

From the Dashboard Uncertified Tier Zero Objects tile or the Tier Zero Objects list, click the object's Principal Name.

 

The following information displays for the selected Tier Zero object:

  • Object Properties:

  • Certification Status

  • Added By (Security Guardian, BloodHound Enterprise or User)

  • Distinguished Name

  • Object ID

  • Object Type

  • Principal Name

  • Domain FQDN

  • Domain SID

  • Date Added

    NOTE: This field displays the signed-in user's local date and time.

  • Information Last Updated

  • for a User object, local admin privileges
  • for a Group object, any other groups it is a member of
  • for a Group Policy object, objects affected by the Group Policy

    NOTE: BloodHound Enterprise classifies domains affected by a Group Policy as OUs.
  • objects that the selected object can control
  • objects that have control over the selected objects.

NOTE: BloodHound Enterprise returns a maximum of 1,000 related objects for each Tier Zero category.

Why Tier Zero?

This section provides the reason why the object is considered Tier Zero. If the object was added by the provider (Security Guardian or Bloodhound Enterprise), the reason is returned by the provider. If the object was manually added by a user, the reason is "Manually added as Tier Zero by <user_principal_that_added_object>".