Active Administrator 8.6.3 - User Guide

Reporting on Active Directory objects

Reporting on Active Directory objects

There are four reports from which to choose. You can export any report to a PDF, HTML, MHT, RTF, Excel, CSV, Text, or Image file.

To run a report on Active Directory® objects

1	Click Security & Delegation | Security.

2	Select a domain controller, if necessary.

NOTE: Use the icons to manage the selected managed domain controller. See Managing domain controllers.

3	Right-click an object or container, point to Reports, and choose a report.

 

Table 15. Active Directory reports

Report	Description
Object Class Summary	Lists the number of objects in a particular class in the selected container and all subcontainers.
Groups with Temporary Members	Lists the groups with users who are assigned a Time-to-Live (TTL) value. The temporary members are listed with the assigned TTL value. NOTE: The Forest functional level must be Windows Server® 2016 or Windows Server 2019, and the Privileged Access Management Feature must be enabled for the forest.
Delegated Permissions	Lists delegated permissions for the object and all child objects.
Active Templates Delegated Permissions	Lists the Active Template applied to the selected object.
Active Templates Delegated Permissions with Details	Lists the Active Templates, with permissions and accounts, applied to the selected object.

Monitoring user logon activity

Monitoring user logon activity

To see user logon activity, you must set up workstation logon auditing and set the options for what type of activity to capture. See Setting up workstation logon auditing and Setting user log on activity.

To monitor user logon activity

1	Click Security & Delegation | User Logon Activity.

The display is based on the chosen settings. See Setting user log on activity.

You can sort the columns or filter the list.

▪	To sort the columns, click the column heading to toggle between ascending and descending.

▪	To filter the list, start typing in the box.

2	Use the tool bar to manage the user logon activity.

 

Table 16. User Logon Activity tool bar

Option	Description
Refresh	Refresh the display.
Logon Details	View details about a selected logon event.
Find User	Find a specific user.
Disable Account Enable Account	Disable or enable a user account.
Enable Auto Updates Disable Auto Updates	Disable or enable automatic updates to the display. If you disable auto updates, click Refresh to update the display.

Managing locked out accounts

Managing locked out accounts

For domains you choose to monitor, you can view, research, and resolve locked out accounts. You can view the reason that account is locked and locate the locked out account in Active Directory®. Based on your research, you can decide to unlock the account or disable it.

Topics 

•	Adding domains to monitor

•	Resolving a locked out account

To managed locked out accounts

1	Click Security & Delegation | Locked Out Accounts.

2	Add the domains to monitor. See Adding domains to monitor.

3	Use the tool bar to manage the locked out accounts.

 

Table 17.  

Option	Description
Refresh	Refresh the display.
Unlock Account	Unlock selected accounts.
Disable Account	Disable or enable selected accounts. A disabled account has a gray icon. An enabled account has a blue icon.
Find User	Locate a user account. See Searching Active Directory.
Locked Out Reason	Research why an account is locked before you decide to unlock it or disable it. See Resolving a locked out account.
Monitored Domains	Add domains to monitor for locked out accounts. See Adding domains to monitor.

Adding domains to monitor

Adding domains to monitor

You must add the domains you want to monitor for locked out accounts.

Adding domains to monitor

1	Click Security & Delegation | Locked Out Accounts.

2	Click Monitored Domains.

3	Click Add.

4	Select the domains to manage.

The domains are added to the list and are enabled by default.

▪	To disable selected domains, click Disable.

▪	To remove selected domains from the list, click Remove.

▪	To enable selected domains, click Enable.

5	Click Close.

6	Click Refresh.

The top pane displays any locked out accounts. You can unlock selected accounts, disable accounts, locate accounts in Active Directory®, and view the reason that accounts are locked.

The bottom pane displays the status of the managed domains. If a domain displays an error, you can copy the error to a text editor.

To copy the error to a text editor

a	Right-click the domain, and choose Copy Error.

b	Open a text editor, such as Notepad, and paste the error from the clipboard.