Microsoft Active Directory monitoring

Get insights into performance and usage of the Microsoft ActiveDirectory services:

• DHCP, DNS, DFS, LDAP, ATQ, Kerberos and NTLM
• AD Network adapters and AD/LSA database
• AD replication status
• LDAP BIND performance, FSMO consistency, AD database disk usage
• System-dependent services status like time synchronization, volume health and network adapter health

This extension obtains signals through WMI queries and execution of the PowerShell snippets, depending on where is the source of specific metric. It is designed to work on the AD hosts where the OneAgent is already deployed.

⚠️ Note: important change. This extension replaces previously available Active Directory monitoring extensions This Dynatrace extension supersedes both Active Directory services and Active Directory extended monitoring extensions.

• Please remove both Active Directory services and Active Directory extended monitoring extensions
• Revisit any metric alerts and dashboards you've created using AD metrics provided by the previously used extensions. You may need to replace previously used metrics with the new ones, as some metrics might have their IDs changed.

• Operational monitoring of your Active Directory services, tenant, for usage, performance and availability
• Analyze trends and baselines of the Active Directory services usage
• Raise alerts on anomalies detected
• Monitor vital AD log signals in Dynatrace

This extension is designed to run locally on your AD servers. It doesn't offer remote monitoring of your AD servers. Additionally, compared to typical extensions, which run as LOCAL SERVICE , this one requires privileges elevated to LOCAL SYSTEM, in order to obtain AD metrics that can only be obtained through execution of the PowerShell scripts.

To start using this extension:

• Install OneAgent on your AD servers
• Configure the Dynatrace OneAgent EEC to run this extension with elevated LOCAL SYSTEM account privileges. To achieve this, in C:ProgramData\dynatrace\oneagent\agent\config\extensionsuser.conf file on AD servers where the extension is intended to run, add a line
  • elevated_privileges_extensions=[com.dynatrace.extension.active-directory-python-unabridged:*]
  • Meaning of this line: elevated_privileges_extensions is a comma-separated list of extensions to run as LOCAL SYSTEM (instead of the default LOCAL SERVICE). The format is: <extensionName>:<extensionVersion>
  • See Q&A section for more details on why the privileged mode is required.
• Activate this extension using the in-product Dynatrace Hub.
• In the extension configuration, enable it on your Active Directory hosts
• When asked on the extension's Active Directory Configuration screen, provide an API token with entities.read and settings.write scopes
  • You need to generate token on your Dynatrace tenant, in Menu > Access Tokens; make sure to give it with entities.read and settings.write scopes
  • Insert the Access Token into the API key configuration field
• You may choose which feature sets you want to activate.
  • Disable feature sets that are not relevant to your environment.
  • This way you will avoid errors reported in the extension log, when the extension will try to retrieve metrics that are not available.
  • See Q&A section for more details.
• Make sure that log monitoring is enabled to be able to efficiently troubleshoot the monitoring.
• Make sure to remove both Active Directory services and Active Directory extended monitoring extensions
  • You don't need Active Directory services extension anymore, as this new extension delivers all metrics previously offered by the Active Directory services extension.
  • You don't need Active Directory extended monitoring extension anymore, as this new extension delivers all metrics previously offered by the Active Directory extended monitoring extension.
  • Note that if you keep the previous extensions intact, you may end up with double metric values.

This extension is intended to work locally on the AD server. It executes:

• WMI queries to obtain metrics from the local WMI metrics store on the AD server where the extension runs.
• PowerShell snippets to access Windows registry and specific AD metrics available only through PowerShell. Several of these metrics map to metrics available through commonly used DCDIAG tool.
• API calls against the OS Service Monitoring, to report AD services availability
• Log ingestion of the AD services logs

Additionally, it delivers:

• Alert templates for time skew monitoring, database file space, ATQ thread usage and replication consistency
• Topology rules and screen definitions that weave this extension metrics into the host entities instantiated by the OneAgent that runs on AD servers
• Log ingest rules, applied on AD hosts, which further enable alerting on AD services-related issues logged into Windows logs system
• Log processing rules, which enrich logs ingested with a field that flag AD-related context where content pertains to AD services
• Log event extraction rules, which scan logs ingested for AD-related context and trigger alerts when log information carries potential AD issue or error information

Log ingest configured by this extension By default, this extension sets up log ingestion rules on hosts where it is installed. AD services logs are used to generate events and further alert on service anomalies and malfunctions.

You can disable log ingestion with a settings toggle in the extension configuration screen. Note that this setting does not control any other log ingestion rules that might have been configured on hosts where this extension has been activated.

Following log ingestion rules are being set up by this extension:

• Windows Event Log
  • source is
    • Active Directory Web Services
    • DFS Replication
    • Directory Service
    • DNS Server
  • and log record level is in (ERROR WARN CRITICAL SEVERE)
• Windows Log
  • source is
    • Windows Application Log
    • Windows System Log,
    • Security

And the following events from each event provider.

• Only on-premises Active Directory deployments are supported
• OneAgent 1.305+ is required (elevated user permissions support is required)
• Azure AD is not supported
• This extension has been verified with Windows Server 2016, 2019, 2022
• Activate this extension locally on your AD hosts. Remote AD monitoring is not supported.

Q: What is the DDU Consumption of this extension?

A: The formula for DDU consumption of the extension is:

( 67 * Number of Domain Controllers
+ (26 * Number of DNS Servers)
+ (11 * Number of DHCPv6 Servers)
+ (15 * Number of DHCPv4 Servers)
) * 525.6 DDUs/year

DDU cost above does not include log lines ingested any possible Log events or Custom events triggered by the extension. For more information on this, please visit the DDU log event cost and DDU custom event cost pages.

Q: I see this extension failing with an Error status in my environment?

A: Verify whether you have specific services running on your AD server. If a service is not running - disable feature set describing that service in the extension configuration. Example error text you may encounter:

**Cannot execute query: DHCPServerv6 on device ******** err:Exception occurred. (Invalid class )**

means you should disable the DHCPv6 feature set because your AD server does not run DHCPv6 service, so extension won't be able to obtain metrics for this service.

Q: Why I can't find NTLM Authentications and Kerberos Authentications metrics?

A: Windows Server 2022 brought a change to the metrics set returned by the Win32_PerfRawData_Lsa_SecuritySystemWideStatistics class. Because of this change, the AD extension is unable to report on "NTLM Authentications" and "Kerberos Authentications" metrics and these metrics have been removed from the extension. Consequently, these metrics won't be reported also when this extension is activated on earlier Windows servers. More information on this change and reasons behind it can be found on Microsoft KB pages.

Q: Does this extension collect KPIs available from DCDIAG?

A: Equivalents of the DCDIAG KPIs are available in Dynatrace:

• NTDS Service - monitored through OneAgent OS Service Monitoring
• Services - monitored through OneAgent OS Service Monitoring
• Replications - similar data is available through parsing of the repadmin outputs, in this extension
• FSMO KnowsOfRoleHolders - can be found as part of the FSMO role holder ping/LDAP metrics
• Advertising - delivered by the FSMO role holder consistency metric

Q: Why do I need to enable elevated privileges for this extension if OneAgent already runs under LocalSystem?

A: Although OneAgent typically runs as LocalSystem account, Python extensions run as LocalService. The LocalService account has the minimum privileges on the local computer, which means it can't run PowerShell snippets that read AD performance counters, access WMI objects that store AD metrics, or run AD-specific cmdlets like repadmin and dcdiag. Therefore, OneAgent needs to be explicitly instructed to run this extension with LocalSystem privileges.

Q: What is the Dynatrace API token used for?

A: API token is required to enable integration of the AD-related log ingestion and the OS service monitoring with out of the box host-level reporting. No metrics are ingested using the API token. API token is used to allow the services to be seen on the Dynatrace Host UA screen and the logs on the AD Instance UA screen.

Q: What do I need OS Service Monitoring for?

A: The extension utilizes the API token to add entries into the OneAgent's OS Service Monitoring. The OneAgent will ingest availibility metrics and alerts so you know when a critical service is down. In some cases log events can refer to the OS Service which emitted the event.

Q: Why is the extension invoking net.exe process periodically?

A: Complete replication status reporting requires information on the SYSVOL share availability on the domain controller. SYSVOL is where all the GPOs (Group Policy Objects) and on-event scripts are located to be shared by all DCs in the domain. If SYSVOL wasn't mounted the DC wouldn't be able to pull GPOs and if users have any on-logon scripts they also wouldn't be run. Extension runs net view command to check availability of the SYSVOL share, which is reported in the SYSVOL Health metric.