As a server administrator, you want to make sure you create the best possible experience for users. For users to reliably gain access to Active Directory, it must be managed and monitored to make sure it functions properly.

Monitoring Active Directory is essential to ensure that directory data remains consistent and users have uninterrupted access to their account and domain resources they require access to.

Importance of Active Directory Monitoring

Active Directory monitoring can check for specific indicators to make sure that problems are resolved when they first arise. Doing so can prevent possible service outages. IT can improve customer satisfaction because customers never experience the consequences of potential problems. The system will also be able to better cope with server outages when they do occur.

Monitoring will also help reveal problems that can lead to slower response times when the users access servers. For example, monitoring could reveal issues with user logon and resource access response times. Optimizing logon times and fast access to resources will contribute to a better overall user experience.

When monitoring Active Directory, administrators can experience better schedule flexibility that makes it easier for them to prioritize workloads. You want to monitor Active Directory to make sure that all of the necessary services are running on each domain controller and that replication is working throughout the domain and each domain controller holds the same data.

Monitoring is also being used to make sure the domain controllers don’t experience excessive CPU usage and that Lightweight Directory Access Protocol (LDAP) queries return a result quickly. Making sure LDAP is responsive speeds up the process of accessing and maintaining directory information services, which will increase productivity and – again – create a better overall user experience.

We’ll list a few of the most common issues below that can be prevented by monitoring your Active Directory and taking the appropriate action when an issue is detected.

Replication Issues

Replication issues can cause Active Directory data to be inconsistent across domain controllers. Proper monitoring will detect replication issues and can prevent problems associated with such issues like lingering AD objects or re-animated objects. Lingering objects emerge when the domain controller does not replicate until after the tombstone lifetime. This problem takes time to correct, since an extensive diagnosis will be required.

If the SYSVOL shared folder fails to replicate correctly, Group Policy objects and security policies are not correctly applied to domain clients.

Account Issues

Sometimes Active Directory can experience logon failures, account lockouts and account creation failures.

Logon failures can results from a trust relationship failure or the inability to perform proper name resolution. Sometimes, the failure results from a mismatch between the password and the computer account. The result is an end-user feeling frustrated not being able to access the domain and its resources.

Account lockouts happen if the PDC emulator is not available or several domain controllers experience a replication failure between each other. Active Directory normally locks out an account to prevent login attempts from overwhelming the server. As a result, account administrators spend their time troubleshooting the issue and are busy trying to help users regain access to their accounts. This wastes time and creates frustration for the user.

Account creation issues occur when there are not enough relative IDs and the RID master is unavailable. The relative ID is a variable length number that serves as a part of an object’s security identifier. The RID master is responsible for allocating security RIDs.

Domain Controller Failure and Application Failure

If the hard drive that holds Ntds.dit runs out of space, the domain controller will fail. Applications can fail when queries against Active Directory – that the application depends on – do not return a response or an incorrect result is returned because of a replication issue.

How to Efficiently Monitor Microsoft Active Directory

Small organizations will likely only need to occasionally check domain controllers. For large enterprises, monitoring solutions must gather large amounts of data and generate easily understandable reports that can help administrators make decisions. The need for a good monitoring solution becomes increasingly more important as the size of the Active Directory increases. There are several monitoring solutions available that can help you establish a good monitoring environment.

Monitis offers the advantage that its solution is cloud-based and therefor doesn’t require a dedicated in-house monitoring system. Windows Monitoring Scripts that interact with Monitis and integrate metric results in the Monitis Dashboard fulfill an important role in monitoring Active Directory. The Active Directory monitoring script creates a custom dashboard Monitor that can be easily adapted to include the metrics you require for your organization. The scripts can be downloaded from here: https://github.com/monitisexchange/Windows-Monitoring-Scripts.

Using these scripts and actively start monitoring Active Directory will help you detect and prevent possible issues with user accounts, directory data and security policies that might lead to server or domain outages and resolve slow response times.

References:

http://technet.microsoft.com/en-us/library/cc961807.aspx

http://technet.microsoft.com/en-us/library/cc961984.aspx

http://www.windowsecurity.com/articles/implementing-troubleshooting-acco...

https://github.com/monitisexchange/Windows-Monitoring-Scripts