08-Implementing an Active Directory Domain Services Monitoring Plan

Lab: Monitoring Active Directory Domain Services • Exercise 1: Monitor AD DS Using Event Viewer. • Exercise 2: Monitor AD DS Using Performance and Reliability Monitor[r]

Module Overview

• Monitoring Active Directory Domain Services Using Event Viewer

• Monitoring Active Directory Domain Servers Using Reliability and Performance Monitor

Lesson 1: Monitoring Active Directory Domain Services Using Event Viewer

• Event Viewer Features

• Demonstration: Overview of the Event Viewer

• Active Directory Domain Services Logs

• What Are Custom Views?

• What Are Subscriptions?

Demonstration: Overview of the Event Viewer

Active Directory Domain Services Logs

The following logs can provide specific information about Active Directory issues:

• Application log connections

• System Log

• DFS Replication log

• Directory Service Log

• DNS Server log

What Are Custom Views? Event 1. Security log Event 2. System log Event 3: DFS log Event Viewer Event Viewer Custom views :

• Allow you to aggregate and filter information from multiple logs into a single view

• Are reusable

What Are Subscriptions?

Demonstration: Configuring Custom Views and Subscriptions

In this demonstration, you will see how to:

• Create a custom view and add the AD DS specific logs to the view

Lesson 2: Monitoring Active Directory Domain

Servers Using Reliability and Performance Monitor • Reliability and Performance Monitor Features

• Demonstration: Overview of the Reliability and Performance Monitor

• Monitoring AD DS Using Performance Monitor

• What Is an Active Directory Baseline?

• Monitoring Service Availability with Reliability Monitor

• Monitoring Active Directory Domain Services Using Data Collector Sets

Reliability and Performance Monitor Features

Reliability and Performance Monitor allows you to:

Perform real-time monitoring

 

Track performance of applications and services

  Collect data   Generate alerts  

Take action when thresholds are reached

 

Generate reports

Demonstration: Overview of the Reliability and Performance Monitor

Monitoring AD DS Using Performance Monitor

Useful NTDS Counters for Monitoring Active Directory: NTDS\ DRA Inbound Bytes Total/sec

 

NTDS\ DRA Outbound Bytes Total/sec

 

NTDS\ DRA Inbound Object

 

NTDS\ DRA Pending Replication Synchronizations

 

NTDS\ Kerberos Authentications/sec

 

NTDS\ NTLM Authentications

What Is an Active Directory Baseline?

A baseline defines what a server looks like under normal workload conditions

 

Baseline measurements should include basic server counters and function specific counters

 

Servers performing different functions will have different baselines measurements

 

Problems areas can be identified by comparing baseline measurements to current statistics

Monitoring Active Directory Domain Services Using Data Collector Sets

• Organizes multiple data collection points into a single component

• Can be grouped with other data collection sets

• Can be incorporated into logs

• Can be created individually or from templates

Data Collector Sets can contain the following types of data collectors:

• Performance counters

• Event trace data

Demonstration: Monitoring AD DS

Lesson 3: Configuring Active Directory Domain Services Auditing

• What Is Active Directory Domain Services Auditing?

• Demonstration: Configuring an Audit Policy

• Types of Events to Audit

What Is Active Directory Domain Services Auditing?

• Active Directory auditing can show old values and new values of changed attributes in audit entries

• Active Directory audit policy is divided into four subcategories

 Directory service access  Directory service changes  Directory service replication

 Detailed Directory service replication

• Only directory service access is enabled for success by default

Demonstration: Configuring an Audit Policy

Event ID Category Event

4662 Directory service access An operation was performed on an Active Directory object 4722 User account management A user account was enabled

4726 User account management A user account was deleted 4738 User account management A user account was changed

5136 Directory service changes An Active Directory object was modified 5137 Directory service changes A new Active Directory object was created

5138 Directory service changes An Active Directory object was undeleted

Demonstration: Configuring AD DS Auditing

Lab: Monitoring Active Directory Domain Services • Exercise 1: Monitor AD DS Using Event Viewer

• Exercise 2: Monitor AD DS Using Performance and Reliability Monitor

• Exercise 3: Configure AD DS Auditing

Logon information

Virtual machine NYC-DC1, NYC-DC2 User name Administrator

Lab Review

• You want to enable the Directory Service Changes

subcategory without enabling a global audit policy How could you this?

• What services must be running on a source computer in order to provide information to a subscription?

Module Review and Takeaways • Review questions

Beta Feedback Tool

• Beta feedback tool helps:

 Collect student roster information, module feedback, and

course evaluations

 Identify and sort the changes that students request, thereby

facilitating a quick team triage

 Save data to a database in SQL Server that you can later

query

Beta Feedback

• Overall flow of module:

 Which topics did you think flowed smoothly, from topic to

topic?

 Was something taught out of order? • Pacing:

 Were you able to keep up? Are there any places where the

pace felt too slow?

 Were you able to process what the instructor said before

moving on to next topic?

 Did you have ample time to reflect on what you learned? Did

you have time to formulate and ask questions?

• Learner activities:

 Which demos helped you learn the most? Why you think

that is?

 Did the lab help you synthesize the content in the module?

Did it help you to understand how you can use this knowledge in your work environment?

 Were there any discussion questions or reflection questions