Security Guardian Current

To understand an environment's security posture, assessments and other calculations leveraging Active Directory and Microsoft Entra ID data require the collection of specific information. This data is crucial for identifying vulnerabilities, misconfigurations, and potential attack paths within Active Directory and Microsoft Entra ID.

To see a comprehensive list of the objects and their collected attributes and properties, see:

Active Directory Data Collection Details

Object	Attribute/Object	Notes
nTDSService	canonicalName cn DistinguishedName dSHeuristics name objectGUID
certificateTemplate	canonicalName cn distinguishedName name NTSecurityDescriptor objectGuid msPKI-Certificate-Name-Flag msPKI-Enrollment-Flag msPKI-Minimal-Key-Size msPKI-RA-Signature pKI-ExtendedKeyUsage
certificationAuthority	canonicalName CN distinguishedName objectGuid name NTSecurityDescriptor
Computer	canonicalName cn description displayName distinguishedName dnsHostName GPLink GPOptions lastLogonTimeStamp msDS-AllowedToActOnBehalfOfOtherIdentity msDS-NeverRevealGroup msDS-RevealOnDemandGroup msDS-SupersededManagedAccountLink msDS-SupersededServiceAccountState name NTSecurityDescriptor objectGuid objectSid operatingSystem operatingSystemServicePack operatingSystemVersion primaryGroupId pwdLastSet samAccountName serverReferenceBL userAccountControl userPrincipalName IsSMB1Enabled IsSpoolerEnabled	* Collection of this data requires Administrator membership on the target computers: IsSMB1Enabled True/False - Indicates if the target computer object has Server Message Block version 1 (SMBv1) enabled IsSpoolerEnabled True/False - Indicates if the target Domain Controller has the Print Spooler service is set to non-disabled state
Container	canonicalName cN distinguishedName name nTSecurityDescriptor objectGUID objectClass
dnsZone	canonicalName cN distinguishedName name objectGuid *SetIsUnsecuredDynamicUpdateAllowed	* Collection of this data requires Administrator membership on the Domain Controller: SetIsUnsecuredDynamicUpdateAllowed True/False - Indicates if the target DNS Zone is set to allow Nonsecure updates
Domain	canonicalName distinguishedName gPLink gPOptions ms-DS-MachineAccountQuota msDS-Behavior-Version name nTSecurityDescriptor objectGUID objectSID
domainDNS	canonicalName cN maxPwdAge minPwdLength name objectGUID pwdHistoryLength pwdProperties
controlAccessRight	canonicalName cN displayName distinguishedName name objectGUID rightsGUID validAccesses
foreignSecurityPrincipal	canonicalName cN description distinguishedName memberOf msDS-PrincipalName name nTSecurityDescriptor objectGUID objectSID
groupPolicyContainer	canonicalName cN displayName distinguishedName gPCFileSysPath name nTSecurityDescriptor objectGUID
Group policy settings	allowAdministratorLockout clearTextPassword SeDenyInteractiveLogonRight SeDenyInteractiveLogonRight SeInteractiveLogonRight SeMachineAccountPrivilege SeRemoteInteractiveLogonRight securityLevel
Group policy scheduled tasks	*Group Policy Scheduled Tasks	* Collects all scheduled tasks found specified in GPOs Computer + User configuration. Located under Preferences \| Control Panel Settings \| Scheduled Tasks
Group	canonicalName cN description displayName distinguishedName groupType iSCriticalSystemObject member memberOf name nTSecurityDescriptor objectGUID objectSID primaryGroupToken sAMAccountName sIDHistory
organizationalUnit	canonicalName distinguishedName name cN nTSecurityDescriptor objectGUID gPLink gPOptions
ms-Kds-Prov-RootKey	canonicalName cN distinguishedName came nTSecurityDescriptor objectGUID
Schema	allowedAttributes canonicalName cN distinguishedName lDAPDisplayName name objectClass objectGUID schemaIDGUID
Secret	canonicalName cN distinguishedName name nTSecurityDescriptor objectGUID
msDS-DelegatedManagedServiceAccount	canonicalName cN description displayName distinguishedName msDS-DelegatedMSAState msDS-SupersededManagedAccountLink msDS-SupersededServiceAccountState msDS-GroupMSAMembership msDS-ManagedAccountPrecededByLinkname nTSecurityDescriptor objectGUID objectSID pwdLastSet sAMAccountName userPrincipalName
msDS-GroupManagedServiceAccount	canonicalName cN description displayName distinguishedName msDS-DelegatedMSAState msDS-SupersededManagedAccountLink msDS-SupersededServiceAccountState msDS-GroupMSAMembership msDS-ManagedAccountPrecededByLink name nTSecurityDescriptor objectGUID objectSID pwdLastSet sAMAccountName userPrincipalName
msDS-ManagedServiceAccount	canonicalName cN description displayName distinguishedName msDS-DelegatedMSAState mSDS-SupersededManagedAccountLink mSDS-SupersededServiceAccountState mSDS-GroupMSAMembership mSDS-ManagedAccountPrecededByLink name nTSecurityDescriptor objectGUID objectSID pwdLastSet sAMAccountName userPrincipalName
Site	canonicalName cN distinguishedName gpPLink gPOptions name nTSecurityDescriptor objectGUID
siteServer	distinguishedName objectGuid serverReference
trustedDomain	canonicalName cN distinguishedName name objectGUID msDS-SupportedEncryptionTypes trustAttributes trustDirection trustPartner trustType
User	adminCount canonicalName cN description displayName distinguishedName lastLogonTimestamp msDS-AllowedToActOnBehalfOfOtherIdentity msDS-AllowedToDelegateTo msDS-SupersededManagedAccountLink msDS-SupersededServiceAccountState name nTSecurityDescriptor objectGUID objectSID primaryGroupID pwdLastSet sAMAccountName servicePrincipalName sIDHistory userAccountControl userPrincipalName

Microsoft Entra ID Data Collection Details

Object	Attribute/Object
Application	AppId CreatedDateTime DeletedDateTime DisplayName Id IdentifierUris KeyCredentials Owners PasswordCredentials VerifiedPublisher
Authorization Policy	AllowedToUseSSPR DefaultUserRolePermissions DisplayName Id
Conditional Access Policy	ApplicationsIncludeApplications ConditionalAccessPolicyIncludeUser ConditionalAccessPolicyExcludeUser ConditionalAccessPolicyIncludeGroup ConditionalAccessPolicyExcludeGroup ConditionalAccessPolicyIncludeRole ConditionalAccessPolicyExcludeRole ConditionsClientAppTypes ConditionsSignInRiskLevels ConditionsUserRiskLevels CreatedDateTime DisplayName GrantControlsBuiltInControls GrantControlsOperator Id ModifiedDateTime SessionControlsContinuousAccessEvaluation SessionControlsSecureSignInSessionIsEnabled SessionControlsSignInFrequencyAuthenticationType SessionControlsSignInFrequencyFrequencyInterval SessionControlsSignInFrequencyIsEnabled State TemplateId
Contact	DisplayName GivenName Id JobTitle Mail OnPremisesLastSyncDateTime OnPremisesSyncEnabled Surname
Device	AccountEnabled ApproximateLastSignInDateTime ComplianceExpirationDateTime CreatedDateTime DeletedDateTime DeviceCategory DeviceId DisplayName DomainName Id IsCompliant OnPremisesLastSyncDateTime OnPremisesSecurityIdentifier OnPremisesSyncEnabled OperatingSystem OperatingSystemVersion RegistrationDateTime TrustType
Directory Role	Description DirectoryRoleMember DisplayName Id IsBuiltIn IsEnabled IsPrivileged Members RoleTemplateId
Group	CreatedDateTime DeletedDateTime Description DisplayName ExpirationDateTime Members Owners GroupTypes Id Mail MailEnabled OnPremisesDomainName OnPremisesLastSyncDateTime OnPremisesNetBiosName OnPremisesSamAccountName OnPremisesSecurityIdentifier OnPremisesSyncEnabled PreferredLanguage RenewedDateTime SecurityIdentifier Visibility
MS Authenticator Policy	ExcludeTarget FeatureSettings Id IncludeTarget State
Organization	BusinessPhones City Country CountryLetterCode CreatedDateTime DefaultUsageLocation DeletedDateTime DisplayName Id IsMultipleDataLocationsForServicesEnabled OnPremisesLastPasswordSyncDateTime OnPremisesLastSyncDateTime OnPremisesSyncEnabled PostalCode PreferredLanguage State Street TechnicalNotificationMails TenantType
Security Defaults Policy	Description DisplayName Id IsEnabled
Service Principal	AccountEnabled AlternativeNames AppDescription AppDisplayName AppId ApplicationAuthenticationClientSignInActivity ApplicationAuthenticationResourceSignInActivity ApplicationTemplateId AppOwnerOrganizationId AppRoleAssignmentRequired CreatedDateTime DelegatedClientSignInActivity DelegatedResourceSignInActivity DeletedDateTime Description DisabledByMicrosoftStatus DisplayName Id KeyCredentials LastSignInActivity Owners PasswordCredentials ServicePrincipalType SignInAudience Tags
Service Principal Permissions	ConsentType PermissionDisplayName(AppRole displayName) PermissionType PermissionValue(AppRole value) ResourceDisplayName ServicePrincipalId
User	AccountEnabled BusinessPhones DisplayName ExternalUserState GivenName Id JobTitle LastPasswordChangeDateTime LastSignInDateTime Mail OnPremisesDomainName OnPremisesLastSyncDateTime OnPremisesSamAccountName OnPremisesSecurityIdentifier OnPremisesSyncEnabled SecurityIdentifier SignInActivity Surname UserPrincipalName UserType
User Registration Details	Id IsAdmin IsMFARegistered MethodsRegistered UserDisplayName UserPrincipalName UserType

製品を選択してください:

サービス向上のために、「Purpose of your Chat（チャットの目的）」を記入してください。

お客様の不具合に推奨されるソリューション

Security Guardian Current - User Guide

Appendix - Data Collection Details

Active Directory Data Collection Details

Microsoft Entra ID Data Collection Details