Active Directory integration

With our Active Directory integration, you can easily monitor the health of your directory services environment and proactively alert on potential issues.

Built with our infrastructure agent, the Active Directory integration gives you a set of pre-built and that let you view your most critical performance data, all in one place.

Tip

This integration falls under the Community project designation in our Open Source categories. This code is developed in the open with input from the community through issues and PRs. There is an active maintainer team within New Relic, as well as troubleshooting support in the New Relic Explorers Hub and documentation available in the project repository.

After setting up the Active Directory integration with New Relic, see your data in a dashboard like this, right out of the box.

Install the infrastructure agent

To see your Active Directory data in New Relic, install our infrastructure agent. The infrastructure agent collects data from Performance Counters, Windows Services, PowerShell scripts, and Windows Event Logs and sends that data to New Relic, where you can use the telemetry to measure the health of your Active Directory environment..

There are two methods to install the infrastructure agent:

Follow our guided install to instrument your system with the infrastructure agent.
Install the infrastructure agent via the command line using our docs.

Instrument Active Directory with New Relic

To instrument Active Directory with the infrastructure agent, follow the below procedures between this doc and the New Relic Active Directory integration repository.

Run the following command in your CLI to clone the New Relic Active Directory integration repository:

bash

$git clone https://github.com/newrelic/newrelic-active-directory-integration.git

Copy the relevant configuration files from the repository to the agent, replacing $ROOT_PATH with the path where you cloned the repository:

# integrations.d
Copy-Item -Path "$ROOT_PATH\newrelic-active-directory-integration\integrations.d\*"     -Destination "C:\Program Files\New Relic\newrelic-infra\integrations.d" -Recurse

# logging.d
Copy-Item -Path "$ROOT_PATH\newrelic-active-directory-integration\logging.d\*"     -Destination "C:\Program Files\New Relic\newrelic-infra\logging.d" -Recurse

Once you've followed all these steps, you can install the Active Directory quickstart from the New Relic I/O catalog to add the relevant dashboard and alerts.

Find and use data

The collection of telemetry from Active Directory depends on various configuration and script files located in the infrastructure agent's directory structure like this:

C:\Program Files\New Relic\newrelic-infra\
    ├── integrations.d
    │   ├── windows-active-directory-performance-counters.ps1
    │   ├── windows-active-directory-performance-counters.yml
    │   ├── windows-active-directory-replication-checks.yml
    │   ├── windows-active-directory-replication-failures.ps1
    │   ├── windows-active-directory-replication-partners.ps1
    │   └── windows-active-directory-services.yml
    └── logging.d
        └── windows-active-directory.yml

Each of these files works together to present a full observability footprint. The resulting telemetry in New Relic consists of Metrics, Events, and Log data.

Performance Counters

Collection of Active Directory Performance Counters is accomplished via Flex using this PowerShell script and associated configuration file:

windows-active-directory-performance-counters.ps1
windows-active-directory-performance-counters.yml

The results of this collection are stored as events named activeDirectoryPerformanceCounters.

Event details

EVENT ATTRIBUTE	COUNTER NAME	DESCRIPTION
`addressBookClientSessions`	`\NTDS\AB Client Sessions`	Number of connected address book client sessions
`inboundFullSyncObjectsRemaining`	`\NTDS\DRA Inbound Full Sync Objects Remaining`	The number of objects remaining until the full synchronization is completed
`draInbound`	`\NTDS\DRA Inbound Values (DNs only)/sec`	The number of object property values received from inbound replication partners that are DNs that reference other objects
`draOutbound`	`\NTDS\DRA Outbound Values (DNs only)/sec`	The number of object property values containing DNs sent to outbound replication partners
`draPendingReplicationSync`	`\NTDS\DRA Pending Replication Synchronizations`	The number of directory synchronizations that are queued for this server but not yet processed
`directoryReadsPerSec`	`\NTDS\DS Directory Reads/sec`	The number of directory reads per second
`directoryWritesPerSec`	`\NTDS\DS Directory Writes/sec`	The number of directory writes per second
`directoryNotifyQueueSize`	`\NTDS\DS Notify Queue Size`	The number of pending update notifications that are queued but not yet transmitted to clients
`directoryThreadsInUse`	`\NTDS\DS Threads in Use`	The current number of threads that the directory service is using
`ldapActiveThreads`	`\NTDS\LDAP Active Threads`	The current number of threads that the LDAP subsytem of the local directory service uses
`ldapBindTime`	`\NTDS\LDAP Bind Time`	The time (in milliseconds) that is taken to complete the last LDAP bind
`ldapClientSessions`	`\NTDS\LDAP Client Sessions`	The number of currently connected LDAP client sessions
`ldapSearchesPerSec`	`\NTDS\LDAP Searches/sec`	The rate at which LDAP clients perform search operations
`ldapSuccessfulBindsPerSec`	`\NTDS\LDAP Successful Binds/sec`	The number of LDAP binds per second
`contextSwitchesPerSec`	`\System\Context Switches/sec`	The combined rate at which all processors on the computer are switched from one thread to another
`processorQueueLength`	`\System\Processor Queue Length`	The number of threads waiting to be executed in queue

See your data

In New Relic, you can query your results with this NRQL pattern:

FROM activeDirectoryHealthChecks SELECT
    latest(addressBookClientSessions),
    latest(inboundFullSyncObjectsRemaining),
    latest(draInbound),
    latest(draOutbound),
    latest(draPendingReplicationSync),
    latest(directoryReadsPerSec),
    latest(directoryWritesPerSec),
    latest(directoryNotifyQueueSize),
    latest(directoryThreadsInUse),
    latest(ldapActiveThreads),
    latest(ldapBindTime),
    latest(ldapClientSessions),
    latest(ldapSearchesPerSec),
    latest(ldapSuccessfulBindsPerSec),
    latest(contextSwitchesPerSec),
    latest(processorQueueLength)
SINCE 1 DAY AGO
LIMIT MAX

Windows Services

Collection of Active Directory Windows Services is accomplished via the native Windows Services integration using this configuration file:

windows-active-directory-services.yml

The results of this collection are stored as dimensional metrics with the decorated label: label.primary_app = 'active_directory'.

Metric details

SERVICE NAME	DESCRIPTION
`ADWS`	Active Directory Web Services
`DFS`	Distributed File System
`DFSR`	DFS Replication
`DNS`	DNS Server
`Dnscache`	DNS Client
`IsmServ`	Intersite Messaging
`kdc`	Kerberos Key Distribution Center
`lanmanserver`	Server
`lanmanworkstation`	Workstation
`Netlogon`	Net logon
`NTDS`	Active Directory Domain Services
`RpcSs`	Remote Procedure Call (RPC)
`SamSs`	Security Accounts Manager
`W32Time`	Windows Time

See your data

In New Relic, you can query your results with this NRQL pattern:

FROM Metric SELECT
    latest(timestamp) AS 'Reporting Time',
    latest(state) AS 'Current State',
    latest(start_mode) AS 'Start Mode'
FACET
    hostname AS 'Host',
    display_name AS 'Display Name',
    service_name AS 'Service Name',
    process_id AS 'Parent PID',
    run_as AS 'Service Account'
WHERE label.primary_app = 'active_directory'
SINCE 1 DAY AGO
LIMIT MAX

Active Directory Replication status

Collection of Active Directory Performance Counters is accomplished via Flex using these two PowerShell scripts and associated configuration file:

windows-active-directory-replication-checks.yml
windows-active-directory-replication-failures.ps1
windows-active-directory-replication-partners.ps1

The results of this collection are stored as events named activeDirectoryReplicationFailures and activeDirectoryReplicationPartners.

Event details

EVENT NAME	ATTRIBUTE	DESCRIPTION
`activeDirectoryReplicationFailures`	`failureCount`	Integer indicating the total count of replication failures that have occurred on the specified domain controller.
`activeDirectoryReplicationFailures`	`failureType`	String representation of the latest type of replication failure experienced by the specified domain controller.
`activeDirectoryReplicationFailures`	`firstFailureTime`	Timestamp (`MM/dd/yyyy h:mm:ss tt`) string indicating the first observed failure on the specified domain controller.
`activeDirectoryReplicationFailures`	`lastError`	Integer indicating the last error code received for a replication failure on the specified domain controller.
`activeDirectoryReplicationFailures`	`server`	String name of the domain controller where the replication failure occurred.
`activeDirectoryReplicationPartners`	`lastReplicationAttempt`	Timestamp (`MM/dd/yyyy h:mm:ss tt`) string indicating the last attempt at replication between the server and partner.
`activeDirectoryReplicationPartners`	`lastReplicationSuccess`	Timestamp (`MM/dd/yyyy h:mm:ss tt`) string indicating the last successful replication between the server and partner.
`activeDirectoryReplicationPartners`	`partner`	Short name of the remote partner for replication.
`activeDirectoryReplicationPartners`	`server`	Short name of the local server for

See your data

In New Relic, you can query your replication statistics with these NRQL patterns:

FROM activeDirectoryReplicationFailures SELECT
    latest(failureType) AS 'Type',
    latest(failureError) AS 'Error',
    latest(firstFailureTime) AS 'First Failure',
    latest(failureCount) AS 'Attempts Made'
FACET
    server
SINCE 1 DAY AGO
LIMIT MAX

FROM activeDirectoryReplicationPartners SELECT
    latest(lastReplicationAttempt) AS 'Last Attempt',
    latest(lastReplicationSuccess) AS 'Last Success'
FACET
    server AS 'Source',
    partner AS 'Partner',
    if(lastReplicationSuccess != lastReplicationAttempt, 'Failed Replication', 'Successful Replication') AS 'Current Status'
SINCE 1 DAY AGO
LIMIT MAX

Windows Event Logs

Collection of Active Directory Windows Events is performed with the integrated log forwarder on the infrastructure agent using this configuration file:

windows-active-directory.yml

The results of this collection are stored as logs with the decorated label: logtype = 'active_directory'.

Log details

CHANNEL	EVENT ID	DESCRIPTION
Security	`4609`	Windows is shutting down
Security	`4616`	The system time was changed
Security	`4625`	An account failed to log on
Security	`4648`	A logon was attempted using explicit credentials
Security	`4649`	A replay attach was detected
Security	`4950`	An IPsec Main Mode security association was established
Security	`4697`	A service was installed in the system
Security	`4713`	Kerberos policy was changed
Security	`4714`	Encrypted data recovery policy was changed
Security	`4719`	System audit policy was changed
Security	`4720`	A user account was created
Security	`4723`	An attempt was made to change an account's password
Security	`4724`	An attempt was made to reset an accounts password
Security	`4725`	A user account was disabled
Security	`4726`	A user account was deleted
Security	`4738`	A user account was changed
Security	`4739`	Domain Policy was changed
Security	`4740`	A user account was locked out
Security	`4781`	A computer account was created
System	`1083`	The security descriptor version number could not be determined
System	`1202`	Security policies were propagated with warning. 0x534 : No mapping between account names and security IDs was done
System	`1265`	The attempt to establish a replication link for the following writable directory partition failed
System	`1311`	The Knowledge Consistency Checker (KCC) has detected problems with the following directory partition
System	`1388`	During the past [number] days; replication errors in one or more directory partitions have caused replication to be disabled for the specified naming context on the current domain controller
System	`1645`	Active Directory Domain Services has detected that the domain is still using the default password for the 'Administrator' account
System	`5805`	The session setup from the computer [computer name] failed to authenticate
System	`5807`	During the past [number] days; there have been a few replication errors in the forest. There may be network or connectivity problems in the forest

See your data

In New Relic, you can query your results with this NRQL pattern:

FROM Log SELECT
  hostname AS 'Host',
  Channel,
  EventID,
  message AS 'Message'
WHERE logtype = 'active_directory'
SINCE 1 DAY AGO
LIMIT MAX

Check the source code

This integration is open source software. That means you can browse its source code and send improvements, or create your own fork and build it.

Tip

Install the infrastructure agent

Instrument Active Directory with New Relic

Step 1. Clone the repository

Step 2. Copy the configuration files to your host

Find and use data

Performance Counters

Event details

See your data

Windows Services

Metric details

See your data

Active Directory Replication status

Event details

See your data

Windows Event Logs

Log details

See your data

Check the source code

Active Directory integration

Tip

Install the infrastructure agent .css-21sua1{background:none;border:none;width:0;padding:0;}

Instrument Active Directory with New Relic

Step 2. Copy the configuration files to your host

Find and use data

Performance Counters

Event details

See your data

Windows Services

Metric details

See your data

Active Directory Replication status

Event details

See your data

Windows Event Logs

Log details

See your data

Check the source code

Install the infrastructure agent