AD monitoring advice

Hi all,

I have to implement Active Directory monitoring. I wanted to ask you guys if you could give me some tips on which templates are useful besides AppInsight for Active Directory, and what alerts I could setup besides the replication one that comes out-of-the-box.

Thank you.

Find more posts tagged with

activedirectory

active-directory

active directory monitoring

ad_monitor

active directory

ad_template

active_directory

Accepted answers

All comments

michael.kent

There's a couple I used to use:

Active Directory Health Checks

Active Directory Group Policy

Is there a specific issue that has caused you to want to monitor Active Directory, perhaps start with a targeted alert for that.

brscott

Everything above plus the below: We do use APP Insights Active Directory, but l don't think we alert on any of it.

LDAP User Experience Monitor (because of services that use AD's LDAP for lookups)

TCP Port Monitor for port 389 (not sure why, I think this might also be monitored in one of the other ones also)

DNS Internal (This checks a DNS Entry in the AD DNS domain)

DNS External (This checks google.com to see if DNS recursive lookups are working)

Active Directory 2016 Domain Controller Security (There is probably a newer version of this)

Active Directory 2016 Services and Counters (There is probably a newer version of this)

(Those above two have many of the thresholds blanked out and it's just used for statistics when troubleshooting issues)

A Powershell script that checks a few specific accounts to see if they get locked out.

An event log monitor that detects a reboot loop (this is left over from a bad patch Microsoft put out once, so we monitor it forevermore )

NTP User experience monitor. TIME IS IMPORTANT!

Then a few things that are not specific to AD.

(Yes, someone turned me loose with an unlimited license)

drevollo

There was no specific incident, but I think it's necessary to monitor AD. Thank you for your suggestions.

michael.kent

I'd suggest starting with the above then coming back when you want to expand it further.