ADLocalGroup

This article outlines the ADLocalGroup node in BloodHound, it describes the node’s properties and possible incoming/outgoing edges.

Representation

The ADLocalGroup node represents a local group on a domain computer.

Node properties

The node supports the properties of the table. Three types of property names will be used, depending on where the property is found:

• Entity Panel: Name shown in the BloodHound UI.
• Database: Name stored in the BloodHound database and returned by the BloodHound API. This is to be used when running Cypher queries.
• Directory: Name collected from the directory the node is stored in, for example, the LDAP name for an Active Directory property.

Entity Panel	Database	Directory	Description
Object ID	objectid	-	The object’s unique identifier in the directory.
Last Collected by BloodHound	lastseen	-	When the object was last collected and ingested in BloodHound.
-	name	Group name + computer FQDN	Name of the group + @ + the FQDN of the computer which it exists on.

Edges

The following edge types may be linked to/from this node. See the edges documentation for more information on the edge types.

Incoming edges

Edge type	Entity panel category
MemberOfLocalGroup	-

Outgoing edges

Edge type	Entity panel category
LocalToComputer	-