Active Directory
This document provides the steps required to configure the Active Directory Inspector.
Quick Details
Recommended Agent: Self-Managed
Supported Agents: Self-Managed
Is Auto-Discovered By: Active Directory
Can Auto-Discover: N/A
Parent/Child Type Inspector: No
Inspection via: Endpoint Agent, CLI
Data Summary: Here
Overview
See it in Action
Operating System Support
This Inspector has limited support when run against domain controllers running Windows Server 2012 R2 or older operating systems.
Windows Agent
These instructions assume that you already have a Windows Agent installed on a domain controller in the Environment (e.g., on the local network). For best results, the agent should be installed directly on a domain controller with DNS and DHCP roles installed. Other agent installation locations, such as on a server other than a domain controller or a domain controller without DNS and DHCP roles installed, may result in an incomplete data print.
For other agent deployment instructions and best practices, refer to our Agents documentation
Inspector Setup Preparation
Active Directory PowerShell Scripts
Upon activation, the Active Directory Inspector will run a series of PowerShell scripts to return data to Liongard.
Ensure your system accounts for these actions to take place by allowlisting the Agent within the applicable software, such as ThreatLocker.
Liongard Inspector Setup
Single Inspector Liongard Setup
In Liongard, navigate to Admin > Inspectors > Inspector Types > Navigate to the Active Directory Inspector > Select Add System.
Fill in the following information:
- Environment: Select the Environment this System should be associated to
- Friendly Name: Suggested "Active Directory [Environment Name]"
- Agent: Select the On-premises Agent installed for this Environment
- Inspector Version: Latest
- Limit Search by Organizational Units (Optional): Specify a semi-colon separated list of OU distinguished names to limit the inspection.
- Note: This will only affect items such as Computers, Users, and Groups.
- Leave this field blank to search all of Active Directory.
- Trimmed Inspector Payload (Optional): Leave this blank unless you have issues with payload size. By choosing a level 1-5 with 5 being the most trimmed Data Print, you will be opting into bringing back a trimmed Inspector payload. Fore more information, please review our documentation.
- Scheduling: The Inspector will default to run once a day at the time the Inspector is set up. Here you can adjust the schedule
Select Save. The Inspector will now be triggered to run within the minute
Optional: Turn on Flexible Asset/Configuration Auto-Updating
If you would like this Inspector's data to be sent to ConnectWise and/or IT Glue, turn on Flexible Assets/Configurations for this Inspector:
- ConnectWise: Admin > Integrations > ConnectWise > Configuration Types > Confirm the "Configuration Auto-Updating" toggle is enabled
- IT Glue: Admin > Integrations > IT Glue > Flexible Assets > Confirm the "Flexible Asset Auto-Updating" toggle is enabled
Active Directory Inspector KB and FAQs
Updated about 1 month ago