Active Administrator Overview
Starting Active Administrator console
Using quick tasks
Using the dashboard
Managing domain controllers
User Provisioning
Certificates
Adding a managed domain controller
Removing a managed domain controller
Accessing a domain controller remotely
Searching Active Directory
Opening the Web Console
Using the Certificates landing page
Managing computers
Managing monitored objects
Managing certificates
Viewing certificate details
Viewing the validation chain
Sending email notifications
Reporting on certificates
Exporting certificates
Installing certificates
Deleting certificates
Managing Certificate Authority
Security & Delegation
Viewing a Certificate Authority summary
Adding a forest
Searching Certificate Authority
Managing Certificate Authority servers
Viewing certificate templates
Viewing events
Configuring Certificate Authority notifications
Viewing Certificate Authority backups
Purging Certificate Authority backups
Managing Purge History
Using the Certificate Repository
Adding a certificate to the repository
Viewing certificate details from the repository
Installing certificates from the repository
Updating certificates in the repository
Reporting on certificates in the repository
Exporting certificates from the repository
Deleting certificates from the repository
Searching certificates
Using the Security & Delegation landing page
Managing security
Active Directory Health
Managing Active Directory objects
Viewing Active Directory objects by type
Reporting on Active Directory objects by type
Viewing native permissions
Viewing Active Template delegations
Resetting passwords
Resetting computers
Moving Active Directory objects
Managing group memberships
Monitoring user logon activity
Managing locked out accounts
Managing password policies
Adding members to a selected group
Adding selected accounts to a group
Adding multiple accounts to selected groups
Reporting on Active Directory objects
Creating a new fine-grained password policy
Linking a password policy
Sending password notifications
Checking delegation status
Managing Active Templates
Creating an Active Template
Copying an Active Template
Categorizing Active Templates
Adding a delegation link
Reporting on Active Templates
Managing inactive accounts
Configuring inactive users and computers
Checking for inactive users and computers
Viewing inactive users and computers history
Reporting on inactive accounts
Purging stale accounts
Sending password reminders
Sending account expiration notifications
Viewing expired accounts
Purging account history
Switching to Active Directory Health
Using the Active Directory Health landing page
Installing Active Directory Health Analyzer agents
Auditing & Alerting
Installing Active Directory Health Analyzer agents into a pool
Installing Active Directory Health Analyzer agents onto domain controllers
Installing Active Directory Health Analyzer agents manually
Setting up automatic Active Directory Health Analyzer agent deployment
Using the Active Directory Health Analyzer agent configuration utility
Excluding domain controllers
Managing the Remediation Library
Analyzing Active Directory health
Managing the Active Directory Health Analyzer tree
Using the analyzer pages
Analyzing health of all domain controllers
Analyzing health of a selected domain controller
Analyzing health of all domains
Analyzing health of a selected domain
Analyzing health of all sites
Analyzing health of a selected site
Analyzing the health of a forest
Analyzing Azure Active Directory
Installing the Azure Active Directory Connect Health Monitoring Agent
Setting up the Azure Active Directory Connect application
Managing Active Directory Health Analyzer alerts
Adding the Azure Active Directory Connect application
Configuring Azure Active Directory Connect application settings
Viewing Azure Active Directory Connect status
Viewing Azure Active Directory Connect alerts
Monitoring Azure Active Directory Connect operations
Viewing Azure Active Directory Connect events
Searching the Metaverse
Viewing Azure Active Directory Connect connectors
Managing the Azure Active Directory Connect Health Monitoring Agent
Setting alerts
Purging and archiving alert history
Viewing alerts and alert history
Filtering alert history
Generating an alert history report
Muting alerts
Clearing mutes
Viewing mute history
Managing alert notifications
Pushing alerts to System Center Operations Manager and SNMP managers
Managing monitored domain controllers
Managing data collectors
Setting permissions for data collectors
Setting data collectors
Adding performance counter data collectors
Adding Windows Services data collectors
Adding Event Log data collectors
Setting an authoritative RODC
Purging and archiving Active Directory Health Analyzer data
Active Directory Health Templates
Managing Active Directory Health Analyzer agents
Using the Troubleshooter
Managing the DFSR service
Running the Directory Service Replication Troubleshooter
Enabling or disabling domain controller replication
Setting directory service log levels
Setting Netlogon parameters
Setting startup and recovery options
Cleaning up metadata
Running online defrag
Replicating Active Directory
Recovering Active Directory Health data
Using the Auditing & Alerting landing page
Managing audit reports
Group Policy
Creating a new audit report
Creating a new audit report by copying a report
Running an audit report
Scheduling audit reports
Changing ownership of scheduled reports
Categorizing audit reports
Using tags to mark events
Adding a comment to an event
Grouping events
Viewing event details
Managing archive reports
Managing audit agents
Excluding domain controllers
Setting up auditing on domain controllers
Installing audit agents
Modifying the audit agent startup account
Modifying the audit agent test account
Updating audit agents
Moving an audit agent
Automating audit agent deployment
Canceling pending automated deployments
Managing alerts
Creating an alert
Managing existing alerts
Changing the alert notification policy
Setting global quiet time
Managing alert history
Managing event definitions
Archiving & purging audit events
Using the Group Policy landing page
Managing Group Policy objects
Active Directory Recovery
Creating a new Group Policy object
Copying Group Policy objects
Copying Group Policy objects between domains
Comparing Group Policy objects
Reporting on Group Policy objects
Managing links
Managing GPOs by container
Creating containers
Linking Group Policy objects
Blocking inheritance
Managing linked GPOs
Reporting on Group Policy objects
Searching for GPO settings
Managing GPO history
Using the GPO repository
Modeling GPO changes
Managing GPO backups
Backing up Group Policy objects
Scheduling a GPO backup
Scheduling a purge of GPO backups
Comparing Group Policy backups
Restoring a Group Policy object
Troubleshooting
Purging GPO history
Using the Active Directory Recovery landing page
Managing Active Directory backups
Restoring from a backup
Purging Active Directory backups
Active Directory Infrastructure
Using the Active Directory Infrastructure landing page
Managing Active Directory sites
DC Management
Browsing Active Directory
Building Active Directory structure
Monitoring replication
Using the replication analyzer
Managing Active Directory trusts
Adding a new site
Adding a new connection
Adding a new subnet
Adding a new site link
Adding a new site link bridge
Reporting on Active Directory
Using the DC Management landing page
Checking domain controller status
Managing services
Monitoring domain controller performance
Managing event logs
DNS Management
Using the DNS Management landing page
Managing DNS servers
Configuration
Adding managed DNS servers
Adding records
Editing records
Deleting records
Running reports
Editing DNS server properties
Editing zone properties
Editing zone permissions
Scavenging records
Monitoring DNS servers
Using the DNS analyzer
Viewing the DNS event log
Searching for DNS records
Using the Configuration landing page
Managing tasks
Defining role-based access
Setting email server options
Configuring SCOM and SNMP Settings
Setting notification options
Setting Active Template options
Setting agent installation options
Setting recovery options
Setting GPO history options
Setting certificate configuration
Diagnostic Console
Setting certificate notifications
Setting up certificate email notifications
Configuring certification authority
Setting security on the repository
Setting service monitoring policy
Managing archive databases
Migrating data to another database
Setting a preferred domain controller
Setting up workstation logon auditing
Deploying the workstation logon audit agent
Enabling the default port for the workstation logon auditing agent
Managing configuration settings
Setting the Active Administrator server
Viewing license details
Running an assessment report
Scheduling an assessment report
Running a configuration report
Managing email addresses
Scheduling a configuration report
Checking status of the AFS server
Setting user options
Setting general user options
Setting options for audit reports
Setting user log on activity
Setting Active Directory Health Analyzer options
Enabling console logging
Managing the Active Directory server
Stopping and starting AFS and ADS services
Setting the services startup accounts
Managing logging for services
Clearing the AFS cache
Setting port numbers for services
Enabling Full-Text Search
Updating Active Administrator licenses
Managing Security
Managing Notification Services
Configuring the Web server
Opening the Diagnostic Console
Using components
Alerts Appendix
Network components
Dataflow components
LSASS components
File Replication components
AD Store components
Active Directory components
Operating System components
Using indicators
Using drilldowns
Domain controller alerts
Event Definitions
PowerShell cmdlets
Active Directory Certificate Services service is not running
Active Directory Domain Services is not running
Active Directory Web Services service is not running
Consecutive replication failures
DC cache hits
DC DIT disk space
DC DIT log file disk space
DC LDAP load
DC LDAP response too slow
DC Memory Usage
DC properties dropped
DC RID pool low
DC SMB connections
DC SYSVOL disk space
DC time sync lost
Detected NO_CLIENT_SITE record
DFS Replication service not running
DFS service is not running
DFSR conflict area disk space
DFSR conflict files generated
DFSR RDC not enabled
DFSR sharing violation
DFSR staged file age
DFSR staging area disk space
DFSR USN records accepted
DFSRS CPU load
DFSRS unresponsive
DFSRS virtual memory
DFSRS working set
DNS Client Service is not running
Domain controller CPU load
Domain controller page faults
Domain controller unresponsive
File Replication Service is not running
File replication (NTFRS) staging space free in kilobytes
GC response too slow
Group policy object inconsistent
Hard disk drive
Intersite Messaging Service is not running
Invalid primary DNS domain controller address
Invalid secondary DNS domain controller address
KDC service is not running
LSASS CPU load
LSASS virtual memory
LSASS working set
Missing SRV DNS record for either the primary or secondary DNS server
NETLOGON not shared
NetLogon service is not running
Orphaned group policy objects exist
Physical memory
Power supply
Primary DNS resolver is not responding
Secondary DNS resolver is not responding
Security Accounts Manager Service is not running
SRV record is not registered in DNS
SYSVOL not shared
W32Time service is not running
Workstation Service is not running
Domain alerts
Conflict encountered during replication
DNS server missing domain SRV records
Domain FSMO role placement
Global catalog server replication latency
Infrastructure operations master hosts a global catalog server
Infrastructure operations master inconsistent
Infrastructure operations master not responding
Missing root PDC time source
Objects exist in the Lost and Found container
PDC operations master inconsistent
PDC operations master not responding
Replication latency
RID operations master inconsistent
RID operations master not responding
RODC allowed password replication policy inconsistent
RODC denied password replication policy inconsistent
Site alerts
Inter-site replication manager
Inter-site replication topology generation disabled
Intra-site replication topology generation disabled
Morphed directories exist in site
No authority in site to resolve universal group memberships
Too few global catalog servers in site
Forest alerts
Domain naming and schema operations masters differ
Domain naming operations master inconsistent
Domain naming operations master is not a GC
Naming operations master not responding
Schema operations master inconsistent
Schema operations master not responding
Schema version inconsistent
Site link settings inconsistent with PDC
Site settings inconsistent with PDC
Subnet settings inconsistent with PDC
Azure Active Directory Connect alerts
What are cmdlets?
Using Active Administrator cmdlets
Using cmdlets to get information about the Active Administrator server
Getting the status of Active Administrator licenses
Getting configuration settings for the Web server
Getting logging status for ADS
Getting operation status for ADS
Getting the port number for ADS
Getting logging status for AFS
Getting operation status for AFS
Getting the port number for AFS
Getting operation status for the HTTP service
Getting the status of Full-Text Search
Getting operation status for the Active Administrator Notification Service
Using cmdlets to manage the Active Administrator server
Updating the Active Administrator license
Setting configuration for the Active Administrator Web server
Switching the setting of Full-Text Search
Setting the startup account for AFS and ADS
Setting the port for ADS
Switching logging status of ADS
Switching operation status of ADS
Setting the port for AFS
Switching logging status of AFS
Switching operation status of AFS
Switching operation status of the HTTP service
Clearing the AFS cache
Setting the startup account for the Active Administrator Notification Service
Switching operation status of the Active Administrator Notification Service
Using cmdlets to manage Active Administrator tasks
DFSRS unresponsive
 |
 |
|
• |
Supported on: Windows Server 2016, Windows Server 2019, and Windows Server 2022 |
|
• |
Required permissions: When monitored locally, only domain user privilege is required. When monitored remotely, the target server must have WMI remote access enabled and the user must be a member of the Distributed COM Users group. |
Description
DFSRS virtual memory
| |
|
Alerts Appendix > Domain controller alerts > DFSRS virtual memory
DFSRS virtual memory
Data collector
Description
The Directory Analyzer agent monitors the DFSRS private bytes performance counter on the domain controller for the DFS Remote Service. If the value in the performance counter goes above the configured threshold for a period exceeding the configured duration, the agent will set this alert condition.
DFSRS working set
| |
|
|
• |
Supported on: Windows Server 2016, Windows Server 2019, and Windows Server 2022 |
|
• |
Required permissions: When monitored locally and remotely, only domain user privilege is required and the user must be a part of the Performance Logs user group. |
Description
The Directory Analyzer agent monitors the DFSRS working set performance counter on the domain controller for the DFSR service. If the value in the performance counter goes above the configured threshold for a period exceeding the configured duration, the agent will set this alert condition.
Resolution
DNS Client Service is not running
| |
|
Alerts Appendix > Domain controller alerts > DNS Client Service is not running
DNS Client Service is not running
Indicates the DNS Client Service is currently not running on the domain controller.
Data collector
Description
The Directory Analyzer agent periodically checks to ensure DNS Client Service is running.
Resolution
Use the Services MCC snap-in or another SCP application to restart the DNS Client Service.