Skip to technology filters Skip to main content
Dynatrace Hub

Extend the platform,
empower your team.

Popular searches:
Home hero bg
Active Directory extended monitoringActive Directory extended monitoring
Active Directory extended monitoring

Active Directory extended monitoring

Enhance Active Directory services monitoring with advanced metrics.

Extension
Free trialDocumentation
A snapshot of advanced AD metrics added to the dashboard
  • Product information
  • Release notes

Overview

This Dynatrace extension is a companion to the Active Directory services monitoring extension and provides an extended set of AD metrics, obtained through dedicated PowerShell cmdlets. This extension is not intended to work alone - it should be activated as a companion to the Active Directory services monitoring extension.

This is intended for users, who: Want to enhance the Active Directory services monitoring already implemented, with additional metrics that characterize:

  • AD replication status
  • DHCP server status and performance
  • System-dependent services status like time synchronization, volume health and network adapter health
  • LDAP BIND performance, ATQ thread usage, FSMO consistency, AD database disk usage

Use cases

Enhance Active Directory services monitoring with advanced metrics.

Get started

Start with activating the Active Directory services monitoring extension. Then activate this extension, as it is intended to enhance the the Active Directory services monitoring.

When enabling this extension, you will be prompted for

  • User name and password to a Windows account
    • Able to logon locally
    • The account requires KEY_READ permission to read registry keys from HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
    • The account requires permission to locally execute PowerShell cmdlets on the AD server
    • If collecting DHCP scope metrics, the user must be part of the DHCP Users group
    • Note that the account doesn't have to be the local account on an AD server. It can be domain account, but it requires local server privileges (registry key read, PS cmdlet run).
  • API token to the Dynatrace tenant on which the extension is activated
    • API token requires the settings.write, settings.read and entities.read scope
    • You need to prepare this token on your Dynatrace tenant (Settings > Integrations > Access tokens) and copy-paste this token into the extension configuration

Details

This extension is intended to work locally on the AD server. It executes:

  • PowerShell cmdlets, locally, to access Windows registry and specific AD metrics available only through PowerShell. Several of these metrics map to metrics available through commonly used DCDIAG tool.
  • API calls against the OS Service Monitoring, to report AD services availability
  • Log ingestion of the AD services logs

The extension package contains:

  • PowerShell snippets that retrieve metrics from the AD server
  • Alert templates for time skew monitoring, database file space, ATQ thread usage and replication consistency
  • Topology rules and screen definitions that weave this extension metrics into the entities managed by the Active Directory services monitoring extension
  • Log ingest rules, applied on AD hosts monitored with this extension, which further enable alerting on AD services-related issues logged into Windows logs system
  • Log processing rules, which enrich logs ingested with a field that flag AD-related context where content pertains to AD services
  • Log event extraction rules, which scan logs ingested for AD-related context and trigger alerts when log information carries potential AD issue or error information

Log ingest configured by this extension By default, this extension sets up log ingestion rules on hosts where it is installed. AD services logs are used to generate events and further alert on service anomalies and malfunctions.

You can disable log ingestion with a settings toggle in the extension configuration screen. Note that this setting does not control any other log ingestion rules that might have been configured on hosts where this extension has been activated.

Following log ingestion rules are being set up by this extension:

  • Windows Event Log
    • source is
      • Active Directory Web Services
      • DFS Replication
      • Directory Service
      • DNS Server
    • and log record level is in (ERROR WARN CRITICAL SEVERE)
  • Windows Log
    • source is
      • Windows Application Log
      • Windows System Log,
      • Security

And the following events from each event provider.

|Event Provider|Event IDs|
|Microsoft-Windows-ADFS|102, 104, 111, 356, 385, 509, 546, 549, 1034, 1036|
|Microsoft-Windows-Directory-Services-SAM|12299, 16643|
|Microsoft-Windows-Time-Service|21, 34, 36|
|DNSAPI|11150, 11162, 11151, 11155, 11163, 11167, 11154, 11166, 11152, 11153, 11164, 11165|
|Microsoft-Windows-Kerberos-Key-Distribution-Center|6, 15, 17|
|Microsoft-Windows-Security-Auditing|1102, 4616, 4621, 4649, 4660, 4675, 4707, 4710, 4712, 4715, 4716, 4730, 4740, 4743, 4764, 4766, 4771, 4866, 4867, 4935, 5025, 5030, 5034, 5035, 5037, 5139, 5141, 5483, 5484, 6008, 6145|
|Microsoft-Windows-CertificationAuthority|0, 3, 5, 9, 16, 17, 19, 20, 21, 22, 23, 28, 33, 34, 35, 38, 39, 40, 42, 43, 44, 48, 49, 51, 59, 60, 63, 65, 74, 75, 78, 82, 83, 86, 87, 90, 92, 94, 95, 96, 98, 99, 100, 102, 106, 107, 130, 132|
|Microsoft-Windows-OnlineResponder|39, 60, 92|

Compatibility information

  • This extension is intended as a companion to the Active Directory services monitoring extension. with advanced metrics.
  • Only on-premises Active Directory deployments are supported.
  • Azure AD is not supported.
  • Verified with Windows Server 2016, 2019 and 2022
  • Required minimum PowerShell version on AD servers is 5.x and above

Q&A

Q: What is the DDU Consumption of this extension?

A: The formula for DDU consumption of the extension is:

 ( 10
+ (17 * number of Domain Controllers)
+ (11 * number of DHCP servers)
+ ( 2 * number of LDAP instances)
 )  * 525.6 DDUs/year

Typical consumption for a single-domain AD server, hosting one DHCP server and one LDAP instance, amounts to 21,024 DDUs/year

DDU cost above does not include log lines ingested any possible Log events or Custom events triggered by the extension. For more information on this, please visit the DDU log event cost and DDU custom event cost pages.

Q: Does this extension collect KPIs available from DCDIAG?

A: All in all - equivalents of the DCDIAG KPIs are available in Dynatrace:

  • NTDS Service - monitored through OneAgent OS Service Monitoring
  • Services - monitored through OneAgent OS Service Monitoring
  • Replications - similar data is available through parsing of the repadmin outputs, in this extension
  • FSMO KnowsOfRoleHolders - can be found as part of the FSMO role holder ping/LDAP metrics
  • Advertising - delivered by the FSMO role holder consistency metric

Q: Why do I need to provide separate credentials in this extension if OneAgent already runs under LocalSystem?

A: An account with additional permissions is required to run this extension due to the kind of metrics it collects. Although OneAgent typically runs as LocalSystem account, Python extensions run as LocalService. The LocalService account has the minimum privileges on the local computer which is why the extension requires an account with enough permissions to read a few registry keys and run cmdlets like repadmin and dcdiag.

Q: Why there is a need to grant KEY_READ permission to HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters?

A: KEY_READ permission to HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters is required to obtain following metrics:

active-directory.database.diskfree
active-directory.database.disk.total
active-directory.database.diskfree.total
active-directory.replication.consistency.status

Q: What is the Dynatrace API token used for?

A: API token is required to enable integration of the AD-related log ingestion and the OS service monitoring with OOTB host-level reporting. No metrics are ingested using the API token. API token is used to allow the services to be seen on the Dynatrace Host UA screen and the logs on the AD Instance UA screen.

Q: What do I need OS Service Monitoring for?

A: The extension utilizes the API token to add entries into the OneAgent's OS Service Monitoring. The OneAgent will ingest availibility metrics and alerts so you know when a critical service is down. In some cases log events can refer to the OS Service which emitted the event.

Q: Does the extension support Group Managed Service Accounts (gMSA)?

A: No the extension does not suport gMSA accounts. The extension can only use local or domain-joined accounts since gMSA accounts are not meant for interactive use. The extension works by impersonating the account provided in the monitoring configuration to execute commands in that user's security context. gMSA accounts cannot be impersonated and therefore aren't able to be used by the extension.

Dynatrace
Documentation
By Dynatrace
Dynatrace support center
Subscribe to new releases
Copy to clipboard

Extension content

Content typeNumber of items included
metric query
1
alerts
4
screen logs cards
1
screen chart groups
12
metric metadata
36
screen properties
1
screen injections
12
generic relationship
2
generic type
6
screen layout
1

Feature sets

Below is a complete list of the feature sets provided in this version. To ensure a good fit for your needs, individual feature sets can be activated and deactivated by your administrator during configuration.

Feature setsNumber of metrics included
Metric nameMetric keyDescriptionUnit
Disk Free Spaceactive-directory.database.diskfree.totalFree disk space of the disk containing the database file.Byte
Total Disk Spaceactive-directory.database.disk.totalTotal disk space of the disk containing the AD database file.Byte
Disk Free Space Percentageactive-directory.database.diskfreePercent of free disk space of the disk containing the database file.Percent
Metric nameMetric keyDescriptionUnit
DHCP Scope Delay v4active-directory.dhcp.server.scope.delayDHCP Scope Delay v4 in millisecondsMilliSecond
DHCP Scope Addresses Free v4active-directory.dhcp.server.scope.addresses.freeNumber of DHCPv4 scope addresses freeCount
DHCP Scope Addresses Used v4active-directory.dhcp.server.scope.addresses.usedNumber of DHCPv4 scope addresses usedCount
DHCP Scope Addresses Reserved v4active-directory.dhcp.server.scope.addresses.reservedNumber of DHCPv4 scope addresses reservedCount
Percent of DHCP Scope Addresses Used v4active-directory.dhcp.server.scope.addresses.used.pctPercent of DHCPv4 scope addresses usedPercent
DHCP Scope Pending Offers v4active-directory.dhcp.server.scope.pending.offersNumber of DHCPv4 scope pending offersCount
Metric nameMetric keyDescriptionUnit
ATQ Average Thread Usageactive-directory.atq.server.average.thread.usageAverage usage of threads in Domain Controller ATQPercent
Metric nameMetric keyDescriptionUnit
LDAP Bind Timeactive-directory.ldap.server.bindtime.millisTime taken to bind to the fsmo role holder using LDAPMilliSecond
LDAP Bind Availabilityactive-directory.ldap.bind.availabilityWhether or not the domain controller can bind to the domain DNS serverCount
Metric nameMetric keyDescriptionUnit
Good Network Adapter Countactive-directory.network.goodadapter.totalThe number of enabled network adapters that can ping the Domain DNS Server.Count
Bad Network Adapter Countactive-directory.network.badadapter.totalThe number of enabled network adapters that cannot ping the Domain DNS Server.Count
Total Network Adapter Countactive-directory.network.adapter.totalThe total number of enabled network adapters.Count
Metric nameMetric keyDescriptionUnit
DHCP Scope Addresses Free v6active-directory.dhcp.server.v6.scope.addresses.freeNumber of DHCPv6 scope addresses freeCount
DHCP Scope Addresses Used v6active-directory.dhcp.server.v6.scope.addresses.usedNumber of DHCPv6 scope addresses usedCount
DHCP Scope Addresses Reserved v6active-directory.dhcp.server.v6.scope.addresses.reservedNumber of DHCPv6 scope addresses reservedCount
Percent of DHCP Scope Addresses Used v6active-directory.dhcp.server.v6.scope.addresses.used.pctPercent of DHCPv6 scope addresses usedPercent
DHCP Scope Pending Advertises v6active-directory.dhcp.server.v6.scope.pending.advertisesNumber of DHCPv6 scope pending advertisesCount
Metric nameMetric keyDescriptionUnit
Kerberos Replication Partner Countactive-directory.replication.partner.countKerberos replication partners count in Active Directory domainCount
Replication Queue Countactive-directory.replication.queue.countCount of items in replication queue by Active Directory Domain Controller monitorCount
Global Catalog Search Response Timeactive-directory.globalcatalog.searchtime.millisGlobal catalog search response time of Domain ControllerMilliSecond
Replication Consistency Statusactive-directory.replication.consistency.statusWhether or not strict replication consistency is enabledCount
Shared Resource Availableactive-directory.replication.shared.availablePercentage of replication shared resources that are availablePercent
Replication - Destination Deltaactive-directory.replication.destination.deltaReplication time delta between this server and the destination server.Second
Replication - Source Deltaactive-directory.replication.source.deltaReplication time delta between this server and the source server.Second
Replication - Destination Errorsactive-directory.replication.destination.errorsReplication errors between this server and the destination server.Count
Replication - Source Errorsactive-directory.replication.source.errorsReplication errors between this server and the source server.Count
Time Skew in secondsactive-directory.timeskew.secsTime difference between the local domain controller and a target domain controllerSecond
Lost and Found Objectsactive-directory.lostandfound.object.count.totalCount of lost and found objects by Active Directory Domain monitorCount
FSMO Role Holder Consistencyactive-directory.fsmoroleholder.consistencyWhether or not the domain controllers agree on who the FSMO role holders areCount
FSMO Checkactive-directory.fsmo.checkContains a 'message' dimension about whether or not the correct services can be found from the domain controllerCount
SYSVOL Healthactive-directory.sysvol.healthThe SYSVOL share's healthCount
Customer story Village Roadshow
“One of the biggest impacts of partnering with Dynatrace is the amount of time given back to our teams. There are no more sleepless nights on the weekends.”
Michael Fagan
Chief Transformation Officer

Related to Active Directory extended monitoring

Active Directory services logo

Active Directory services

Monitor the health and performance of Microsoft Active Directory services.

Full version history

To have more information on how to install the downloaded package, please follow the instructions on this page.
ReleaseDate

Full version history

Patch level changes

  • Fixed Lost&Found object counter - report number every minute instead of monotonically growing counter
  • Added missing ADCS log ingest activation toggle in settings
  • Updated Q&A with information on OS services monitoring and comprehensive list of imported log events

Full version history

  • Fixed an issue with the is_read_only dimension having the wrong value
  • Replaced the Powershell script with a command so users that enforce Powershell script signing can get replication summary metrics

Full version history

Patch level changes:

  • Fix issue with indexing the domain name returned by one of the WMI queries, which resulted in empty domain name reported

Full version history

Enhancements:

  • Added monitoring config option for query interval
  • Added Credential Vault support

Patch level changes:

  • Fixed bug with services cleanup on shutdown

Full version history

Patch level changes:

  • Added the source entity type for all metrics
  • Fixed bug with GC query in FSMO Check
  • Fix to improve execution time of complex metrics
  • TrustMonitor metric is based on log events now, as it might have many unique dimensions
  • Added hub tile information on log ingest rules set up by this extension

Full version history

Now the extension supports running it on the AD non-server nodes, e.g. a separate DHCP server.

Full version history

Fixed irregularities when accessing specific Registry keys required to obtain ReplicationConsistencyMetrics and DatabaseFileDiskSpaceMetrics.

Full version history

Enhance Active Directory services monitoring with advanced metrics.

Dynatrace Hub
Hub HomeGet data into DynatraceBuild your own app
All (717)Log Management and AnalyticsKubernetesAI/ML ObservabilitySoftware DeliveryApplication ObservabilityApplication SecurityDigital ExperienceBusiness Analytics
Filter
Type
Built and maintained by
Deployment model
SaaS
  • SaaS
  • Managed
Partner FinderBecome a partnerDynatrace Developer

Infrastructure Observability

Get automatic and intelligent observability across cloud and hybrid environments with continuous auto-discovery of any type of infrastructure, all in context and with precise, AI-powered answers.

Essentials

Get automatic and intelligent infrastructure monitoring and observability across hybrid and cloud environments.

OneAgent logo

OneAgent

The simplest way to capture all observation signals automatically and in context

Discovery & Coverage logo

Discovery & Coverage

Ensure enterprise-wide visibility. Discover and remediate coverage gaps.

Kubernetes logo

Kubernetes

Harness automation and AI to simplify Kubernetes observability at scale.

Infrastructure & Operations logo

Infrastructure & Operations

Detailed hosts, VMs, process, and network insights across the entire environment

Databases logo

Databases

Contextualized view of databases for DBAs and app owners.

Clouds logo

Clouds

Unified cloud observability and governance platform.

Hybrid cloud

AWS logo

AWS

Reliable, scalable, and inexpensive cloud computing services.

Microsoft Azure logo

Microsoft Azure

Cloud computing service for building, testing, deploying, and managing services.

Google Cloud logo

Google Cloud

Meet your business challenges head on with cloud computing services from Google.

VMware logo

VMware

Monitor health and performance of VMware virtual machines.

Nutanix Clusters logo

Nutanix Clusters

Monitor Nutanix clusters for performance, usage and availability, with Prism API

Microsoft Hyper-V Infrastructure logo

Microsoft Hyper-V Infrastructure

Monitor health and performance of the Hyper-V clusters, hosts and VMs.

Technology coverage

F5 BIG-IP logo

F5 BIG-IP

Gain insights into the performance of your F5 BIG-IP LTM and DNS solutions.

Oracle Database logo

Oracle Database

Observe, analyze and optimize the usage, health and performance of your database

Microsoft SQL Server logo

Microsoft SQL Server

Improve the health and performance monitoring of your Microsoft SQL Servers.

Also popular

See more (6)
Juniper Networks (SNMP) logo

Juniper Networks (SNMP)

Start monitoring your Juniper Network devices to collect metrics and enable alerting on top of them.

SNMP Traps logo

SNMP Traps

Supplement network device statistics with event-based data reported via SNMP Traps.

Generic Cisco Device logo

Generic Cisco Device

Monitor Cisco devices using SNMP to feed Dynatrace with metrics and alerts.

Active Directory services logo

Active Directory services

Monitor the health and performance of Microsoft Active Directory services.

Palo Alto firewalls logo

Palo Alto firewalls

Palo Alto extension for problems detection

Remote Windows Host Monitoring logo

Remote Windows Host Monitoring

Monitor health and performance of Windows Hosts without installing an agent.

More resources

Google Cloud Storage logo

Google Cloud Storage

Get insights into Google Cloud Storage metrics collected from the Google Operations API to ensure health of your cloud infrastructure.

Azure Cosmos DB logo

Azure Cosmos DB

Fully managed and serverless distributed database supporting open-source PostgreSQL, MongoDB, and Apache Cassandra.

Google Cloud IoT Core logo

Google Cloud IoT Core

Get insights into Google Cloud IoT Core metrics collected from the Google Operations API to ensure health of your cloud infrastructure.

Azure Event Grid Topics logo

Azure Event Grid Topics

Topic based events for serverless and event based workflows.

Google Memorystore logo

Google Memorystore

Get insights into Google Memorystore service metrics collected from the Google Operations API to ensure health of your cloud infrastructure.

Amazon Kinesis Data Firehose logo

Amazon Kinesis Data Firehose

Fully managed service for delivering real-time streaming data.

Azure Content Moderator logo

Azure Content Moderator

AI service for content moderation and human review tool for images, text, and videos.

Azure Speech To Text logo

Azure Speech To Text

An AI service that accurately converts spoken audio to text.

Amazon Translate logo

Amazon Translate

Text translation service using machine learning to provide high-quality translation on demand.

Azure Data Box Edge logo

Azure Data Box Edge

Rebranded as Azure Stack Edge. ... Azure Stack Edge is a Hardware-as-a-service solution.

coming soon
Active Directory extended monitoring logo

Active Directory extended monitoring

Enhance Active Directory services monitoring with advanced metrics.

Google Cloud Storage Transfer logo

Google Cloud Storage Transfer

Get insights into Google Cloud Storage Transfer metrics collected from the Google Operations API to ensure health of cloud infrastructure.

Azure Data Lake Storage logo

Azure Data Lake Storage

Fully-managed, elastic, scalable, and secure file system that supports HDFS semantics and works with the Hadoop ecosystem.

Oracle Connector Hub signals ingest logo

Oracle Connector Hub signals ingest

Observe OCI services with signals ingested from the Oracle Connector Hub

Amazon Rekognition logo

Amazon Rekognition

Amazon Rekognition makes it easy to add image and video analysis to your applications.

Amazon Elasticsearch Service logo

Amazon Elasticsearch Service

Fully managed service to deploy, secure, and run Elasticsearch cost effectively at scale, without the operational overhead.

Google Cloud Filestore logo

Google Cloud Filestore

Monitor your Google Cloud Filestore services using metrics ingested to your Dynatrace cluster.

Azure Service Bus logo

Azure Service Bus

Cloud messaging as a service (MaaS) and simple hybrid integration.

Azure Ink Recognizer logo

Azure Ink Recognizer

An AI service that provides a cloud-based REST API to analyze and recognize digital ink content.

Google Firebase logo

Google Firebase

Get insights into Google Firebase service metrics collected from the Google Operations API to ensure health of your cloud infrastructure.

Azure Spring Apps logo

Azure Spring Apps

Brings modern microservice patterns to Spring Boot apps eliminating boilerplate code to quickly develop robust Java apps.

Amazon Quantum Ledger Database (QLDB) logo

Amazon Quantum Ledger Database (QLDB)

Ledger by a central trusted authority that provides an immutable, and cryptographically verifiable transaction log.

Amazon Cognito logo

Amazon Cognito

Add user sign-up, sign-in, and access control to your web and mobile apps quickly and easily.

Azure Data Factory logo

Azure Data Factory

Cloud-based ETL and data integration service for creating data-driven workflows for moving and transforming data at scale.

Amazon WorkMail logo

Amazon WorkMail

Secure, managed business email and calendaring service with support for existing desktop and mobile email clients.

Azure Time Series Insights logo

Azure Time Series Insights

Fully managed analytics, storage, and visualization service for managing IoT-scale time-series data in the cloud.

Azure DNS Zones logo

Azure DNS Zones

Data resource that contains the DNS records for a domain name.

Azure Database for PostgreSQL logo

Azure Database for PostgreSQL

Full insight into database performance for critical workloads with AI-problem detection and more.

Azure Front Door (classic) logo

Azure Front Door (classic)

Optimize application performance with visibility into requests and latency, ensuring routing efficiency and backend health.

AWS Outposts logo

AWS Outposts

Fully managed service that extends AWS infrastructure, AWS services, APIs, and much more.

Azure App Service logo

Azure App Service

Intelligent end-to-end observability for serverless and hybrid environments using Azure App Services.

Azure Analysis Services logo

Azure Analysis Services

Fully managed platform as a service (PaaS) that provides enterprise-grade data models in the cloud.

Fortinet FortiGate logo

Fortinet FortiGate

Gain insights into the performance of your Fortinet FortiGate solution.

AWS IoT logo

AWS IoT

Run local compute, messaging, data caching, and machine learning inference capabilities.

Azure NetApp Capacity Pool logo

Azure NetApp Capacity Pool

Enterprise-class, high-performance, metered file storage service.

Azure Application Gateway logo

Azure Application Gateway

Web traffic load balancer that enables you to manage traffic to your web applications.

Amazon Simple Email Service (SES) logo

Amazon Simple Email Service (SES)

Cloud-based service that helps developers send marketing, notification, and transactional emails.

Azure Anomaly Detector logo

Azure Anomaly Detector

Detects anomalies in time series data with numerical values that are uniformly spaced in time.

Google Cloud APIs logo

Google Cloud APIs

Get insights into Google Cloud APIs service metrics collected from the Google Operations API to ensure health of your cloud infrastructure.

Amazon FSx for Windows File Server logo

Amazon FSx for Windows File Server

Provides a managed Microsoft Windows file servers, backed by a native Windows file system.

Amazon VPC (NAT Gateway) logo

Amazon VPC (NAT Gateway)

Connect to the Internet from instances within a private subnet in an AWS Virtual Private Cloud.

Google Cloud Run logo

Google Cloud Run

Dynatrace provides AI-powered observability into serverless containerized apps running on Google Cloud Run.

Azure Application Insights logo

Azure Application Insights

An extensible Application Performance Management (APM) service for developers and DevOps.

Azure Container Registries logo

Azure Container Registries

Managed, private Docker registry service based on the open-source Docker Registry 2.0.

Azure Face logo

Azure Face

An AI service that analyzes faces in images.

Amazon EC2 Spot Fleet logo

Amazon EC2 Spot Fleet

Spot Instances and On-Demand Instances to meet the target capacity that you specified.

Google Cloud Spanner logo

Google Cloud Spanner

Get insights into Google Cloud Spanner metrics collected from the Google Operations API to ensure health of your cloud infrastructure.

Amazon Simple Notification Service (SNS) logo

Amazon Simple Notification Service (SNS)

Provides a simple web services interface that can be used to create topics you want to notify apps.

Are you looking for something different?

We have hundreds of apps, extensions, and other technologies to customize your environment

Extend your knowledge

Learn the Dynatrace Query Language

Learn the Dynatrace Query Language

Explore data, discover patterns, anomalies and outliers, and create statistical modeling with DQL, our powerful query language..
Learn DQL
Get certified and advance your career

Get certified and advance your career

Go to Dynatrace University for practical, on-demand courses and learning paths -- from platform basics to key certifications.
Build skills