• 成为门户专家
• 下载
• 打印
• 我的下载 ()

• 支持
• 技术说明文件
• Active Administrator 8.6.3
• Active Administrator 8.6.3 - User Guide

Active Administrator 8.6.3 - User Guide

内容导航  

Active Administrator Overview

Starting Active Administrator console Using quick tasks Using the dashboard Managing domain controllers

Adding a managed domain controller Removing a managed domain controller Accessing a domain controller remotely

Searching Active Directory Opening the Web Console

User Provisioning

Using the Provisioning landing page

Provisioning Users Editing the Provisioning Template Deprovisioning Users Viewing the provisioning and deprovisioning logs Purging the logs

Certificates

Using the Certificates landing page Managing computers

Adding computers Excluding stores Removing computers Disabling certificate management

Managing monitored objects Managing certificates Viewing certificate details Viewing the validation chain Managing broken certificates Sending email notifications

Excluding certificates that support cryptography Excluding revoked certificates

Reporting on certificates

Sending a report Managing report schedules

Exporting certificates Installing certificates Deleting certificates Managing Certificate Authority

Viewing a Certificate Authority summary Adding a forest Searching Certificate Authority Managing Certificate Authority servers Viewing certificate templates Viewing events Configuring Certificate Authority notifications Viewing Certificate Authority backups Purging Certificate Authority backups Managing Purge History

Using the Certificate Repository

Adding a certificate to the repository Viewing certificate details from the repository Installing certificates from the repository Updating certificates in the repository Reporting on certificates in the repository Exporting certificates from the repository Deleting certificates from the repository

Searching certificates

Searching for certificates Creating a new certificate search definition Editing a certificate search definition Deleting a certificate search definition

Security & Delegation

Using the Security & Delegation landing page Managing security

Managing Active Directory objects Viewing Active Directory objects by type Reporting on Active Directory objects by type Viewing native permissions

Setting the owner Managing native permissions Removing propagation

Viewing Active Template delegations Resetting passwords Resetting computers Moving Active Directory objects Managing group memberships

Adding members to a selected group Adding selected accounts to a group Adding multiple accounts to selected groups

Reporting on Active Directory objects

Monitoring user logon activity Managing locked out accounts

Adding domains to monitor Resolving a locked out account

Managing password policies

Creating a new fine-grained password policy Linking a password policy Sending password notifications

Checking delegation status

Adding a delegation

Managing Active Templates

Creating an Active Template Copying an Active Template Categorizing Active Templates Adding a delegation link Reporting on Active Templates

Managing inactive accounts

Configuring inactive users and computers Checking for inactive users and computers Viewing inactive users and computers history Reporting on inactive accounts Purging stale accounts

Sending password reminders Sending account expiration notifications Viewing expired accounts Purging account history

Archiving account history on demand Purging account history on demand Scheduling an account history purge and archive

 Active Directory Health

Switching to Active Directory Health Using the Active Directory Health landing page Installing Active Directory Health Analyzer agents

Installing Active Directory Health Analyzer agents into a pool Installing Active Directory Health Analyzer agents onto domain controllers Installing Active Directory Health Analyzer agents manually Setting up automatic Active Directory Health Analyzer agent deployment

Using the Active Directory Health Analyzer agent configuration utility

Setting network settings Enable logging

Excluding domain controllers Managing the Remediation Library

Adding custom remediations Deleting custom remediations

Analyzing Active Directory health

Managing the Active Directory Health Analyzer tree Using the analyzer pages Analyzing health of all domain controllers Analyzing health of a selected domain controller Analyzing health of all domains Analyzing health of a selected domain Analyzing health of all sites Analyzing health of a selected site Analyzing the health of a forest

Analyzing Azure Active Directory

Installing the Azure Active Directory Connect Health Monitoring Agent Setting up the Azure Active Directory Connect application

Adding the Azure Active Directory Connect application Configuring Azure Active Directory Connect application settings

Viewing Azure Active Directory Connect status Viewing Azure Active Directory Connect alerts Monitoring Azure Active Directory Connect operations Viewing Azure Active Directory Connect events Searching the Metaverse Viewing Azure Active Directory Connect connectors Managing the Azure Active Directory Connect Health Monitoring Agent

Managing the agent from the Agents tab Managing the agent from the command line

Managing Active Directory Health Analyzer alerts

Setting alerts Purging and archiving alert history Viewing alerts and alert history Filtering alert history Generating an alert history report Muting alerts Clearing mutes Viewing mute history

Managing alert notifications

Creating alert notifications Editing alert notifications Removing alert notifications

Pushing alerts to System Center Operations Manager and SNMP managers

Limiting alert notifications

Managing monitored domain controllers

Adding monitored domain controllers

Managing data collectors

Setting permissions for data collectors Setting data collectors Adding performance counter data collectors Adding Windows Services data collectors Adding Event Log data collectors Setting an authoritative RODC Purging and archiving Active Directory Health Analyzer data

Active Directory Health Templates

Creating and Applying Active Directory Health Templates Managing Active Directory Health Templates

Managing Active Directory Health Analyzer agents

Managing agent workload Sending agent notifications Monitoring agent performance

Setting up performance monitoring Viewing agent performance

Using the Troubleshooter

Managing the DFSR service Running the Directory Service Replication Troubleshooter Enabling or disabling domain controller replication Setting directory service log levels Setting Netlogon parameters Setting startup and recovery options Cleaning up metadata Running online defrag Replicating Active Directory

Recovering Active Directory Health data

Preparing for data recovery Restoring the Active Directory Health module and data

Auditing & Alerting

Using the Auditing & Alerting landing page Managing audit reports

Creating a new audit report Creating a new audit report by copying a report Running an audit report Scheduling audit reports Changing ownership of scheduled reports Categorizing audit reports Using tags to mark events Adding a comment to an event Grouping events Viewing event details

Managing archive reports Managing audit agents

Excluding domain controllers Setting up auditing on domain controllers Installing audit agents Modifying the audit agent startup account Modifying the audit agent test account Updating audit agents Moving an audit agent Automating audit agent deployment Canceling pending automated deployments

Managing alerts

Creating an alert Managing existing alerts Changing the alert notification policy Setting global quiet time Managing alert history

Filtering alert history Viewing alert history details Resending an alert notification Creating an alert history report

Managing event definitions

Importing new event definitions Excluding account events from auditing

Archiving & purging audit events

Archiving events on demand Purging events on demand Setting purge and archive options Scheduling an event log purge and archive Managing the history log Running database maintenance

Group Policy

Using the Group Policy landing page Managing Group Policy objects

Creating a new Group Policy object Copying Group Policy objects Copying Group Policy objects between domains Comparing Group Policy objects Reporting on Group Policy objects Managing links

Adding a link

Managing GPOs by container

Creating containers Linking Group Policy objects Blocking inheritance Managing linked GPOs

Comparing linked GPOs

Reporting on Group Policy objects

Searching for GPO settings Managing GPO history

Rolling back Group Policy

Using the GPO repository

Adding a GPO to the repository Editing a GPO offline

Modeling GPO changes

Creating a simulation

Managing GPO backups

Backing up Group Policy objects Scheduling a GPO backup Scheduling a purge of GPO backups Comparing Group Policy backups Restoring a Group Policy object

Troubleshooting

Enabling logging Updating Group Policy

Purging GPO history

Purging GPO history on demand Scheduling a GPO history purge

Active Directory Recovery

Using the Active Directory Recovery landing page Managing Active Directory backups Restoring from a backup Purging Active Directory backups

Purging Active Directory backups on demand Scheduling an Active Directory backup purge

Active Directory Infrastructure

Using the Active Directory Infrastructure landing page Managing Active Directory sites

Browsing Active Directory Building Active Directory structure

Adding a new site Adding a new connection Adding a new subnet Adding a new site link Adding a new site link bridge

Reporting on Active Directory

Monitoring replication

Adding a forest

Using the replication analyzer Managing Active Directory trusts

Adding a forest trust Adding a domain trust

DC Management

Using the DC Management landing page Checking domain controller status Managing services Monitoring domain controller performance Managing event logs

DNS Management

Using the DNS Management landing page Managing DNS servers

Adding managed DNS servers Adding records Editing records Deleting records Running reports Editing DNS server properties Editing zone properties Editing zone permissions Scavenging records

Monitoring DNS servers

Setting testing options Creating tests Running tests Editing a test Deleting a test

Using the DNS analyzer Viewing the DNS event log

Using custom filters

Creating custom filters Applying custom filters Editing custom filters Deleting custom filters

Setting display options

Searching for DNS records

Configuration

Using the Configuration landing page Managing tasks Defining role-based access

Adding a new user or group to Active Administrator

Setting email server options Configuring SCOM and SNMP Settings Setting notification options Setting Active Template options Setting agent installation options Setting recovery options

Adding a domain Enabling or disabling password recovery

Setting GPO history options Setting certificate configuration

Setting certificate notifications Setting up certificate email notifications Configuring certification authority Configuring certificate protection Setting security on the repository

Setting service monitoring policy Managing archive databases

Creating an archive database Modifying archive database settings

Migrating data to another database Setting a preferred domain controller Setting up workstation logon auditing

Deploying the workstation logon audit agent

Enabling workstation auditing Deploying the workstation logon agent Deploying the workstation logon agent from a GPO

Enabling the default port for the workstation logon auditing agent

Managing configuration settings

Setting the Active Administrator server Viewing license details Running an assessment report Scheduling an assessment report Running a configuration report Managing email addresses

Managing the AA Owner email address

Scheduling a configuration report Checking status of the AFS server

Setting user options

Setting general user options Setting options for audit reports Setting user log on activity Setting Active Directory Health Analyzer options Enabling console logging

Managing the Active Directory server

Stopping and starting services Setting the services startup accounts Managing logging for services Clearing the AFS cache Setting port numbers for services Enabling Full-Text Search Updating Active Administrator licenses Configuring the Web server

Diagnostic Console

Opening the Diagnostic Console Using components

Network components Dataflow components LSASS components File Replication components AD Store components Active Directory components Operating System components

Using indicators Using drilldowns

Performance drilldown

Top CPU Consumers tab Top Memory Consumers tab All Processes tab

Replication drilldown

Activity tab Queues tab Directory Partners tab FRS Replicas tab Collisions tab

Configuration drilldown

Installed Hotfixes tab Installed Software tab Network Adapters tab

DNS drilldown LSASS drilldown LDAP drilldown FSMO Roles drilldown

Alerts Appendix

Domain controller alerts

Active Directory Certificate Services service is not running Active Directory Domain Services is not running Active Directory Web Services service is not running Consecutive replication failures DC cache hits DC DIT disk space DC DIT log file disk space DC LDAP load DC LDAP response too slow DC Memory Usage DC properties dropped DC RID pool low DC SMB connections DC SYSVOL disk space DC time sync lost Detected NO_CLIENT_SITE record DFS Replication service not running DFS service is not running DFSR conflict area disk space DFSR conflict files generated DFSR RDC not enabled DFSR sharing violation DFSR staged file age DFSR staging area disk space DFSR USN records accepted DFSRS CPU load DFSRS unresponsive DFSRS virtual memory DFSRS working set DNS Client Service is not running Domain controller CPU load Domain controller page faults Domain controller unresponsive File Replication Service is not running File replication (NTFRS) staging space free in kilobytes GC response too slow Group policy object inconsistent Hard disk drive Intersite Messaging Service is not running Invalid primary DNS domain controller address Invalid secondary DNS domain controller address KDC service is not running LSASS CPU load LSASS virtual memory LSASS working set Missing SRV DNS record for either the primary or secondary DNS server NETLOGON not shared NetLogon service is not running Orphaned group policy objects exist Physical memory Power supply Primary DNS resolver is not responding Secondary DNS resolver is not responding Security Accounts Manager Service is not running SRV record is not registered in DNS SYSVOL not shared W32Time service is not running Workstation Service is not running

Domain alerts

Conflict encountered during replication DNS server missing domain SRV records Domain FSMO role placement Global catalog server replication latency Infrastructure operations master hosts a global catalog server Infrastructure operations master inconsistent Infrastructure operations master not responding Missing root PDC time source Objects exist in the Lost and Found container PDC operations master inconsistent PDC operations master not responding Replication latency RID operations master inconsistent RID operations master not responding RODC allowed password replication policy inconsistent RODC denied password replication policy inconsistent

Site alerts

Inter-site replication manager Inter-site replication topology generation disabled Intra-site replication topology generation disabled Morphed directories exist in site No authority in site to resolve universal group memberships Too few global catalog servers in site

Forest alerts

Domain naming and schema operations masters differ Domain naming operations master inconsistent Domain naming operations master is not a GC Naming operations master not responding Schema operations master inconsistent Schema operations master not responding Schema version inconsistent Site link settings inconsistent with PDC Site settings inconsistent with PDC Subnet settings inconsistent with PDC

Azure Active Directory Connect alerts

Windows Services alerts Connectivity alerts Event ID alerts

Event Definitions PowerShell cmdlets

What are cmdlets? Using Active Administrator cmdlets Using cmdlets to get information about the Active Administrator server

Getting the status of Active Administrator licenses Getting configuration settings for the Web server Getting logging status for ADS Getting operation status for ADS Getting the port number for ADS Getting logging status for AFS Getting operation status for AFS Getting the port number for AFS Getting operation status for the HTTP service Getting the status of Full-Text Search Getting operation status for the Active Administrator Notification Service

Using cmdlets to manage the Active Administrator server

Updating the Active Administrator license Setting configuration for the Active Administrator Web server Switching the setting of Full-Text Search Setting the startup account for AFS and ADS Setting the port for ADS Switching logging status of ADS Switching operation status of ADS Setting the port for AFS Switching logging status of AFS Switching operation status of AFS Switching operation status of the HTTP service Clearing the AFS cache Setting the startup account for the Active Administrator Notification Service Switching operation status of the Active Administrator Notification Service

Using cmdlets to manage Active Administrator tasks

Active Templates and Delegations Cmdlets

About us

• Viewing Topics 489 - 492 of 554

×

Infrastructure operations master not responding

•	Supported on: Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019

•	Required permissions: Domain user privilege is required.

Description

The Active Administrator® Foundation Service (AFS) periodically queries to find the response time of the infrastructure operations master. If the response time is above the threshold, an alert is generated.

This error can occur if any of the following occurs:

•	The indicated server domain controller does not exist.

•	The domain controller no longer has connectivity to the network and to the Directory Analyzer agent.

•	The DNS records for the domain controller are incorrect; e.g., the IP address for the domain controller is not what is published in DNS as viewed by the Directory Analyzer agent.

•	Active Directory® on the domain controller has failed in some way.

•	Active Directory on the domain controller is overloaded and is taking too long to respond.

•	The domain controller is not running.

Resolution

•	Ping the domain controller from the Directory Analyzer agent to see if there is connectivity. If there is not, fix that problem. The problem may be that DNS has the incorrect address or that the IP stack for the domain controller or the Directory Analyzer agent is misconfigured.

•	Make sure the domain controller is running. If the domain controller is not running, start it.

•	Make sure the indicated domain controller actually exists. If it does not exist, run NTDSUTIL and select the metadata cleanup option to clean up the erroneous objects in the directory.

•	Check the LDAP response time for the domain controller on the Active Directory tab in Active Directory Health Analyzer. If it is too high, you may need to add another domain controller for the same domain in the same site.

Missing root PDC time source

•	Supported on: Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019

•	Required permissions: Domain user privilege is required and the target server must have WMI remote access enabled. The user must be a member of the Distributed COM Users group.

Description

Since Active Directory®, by default, sets all the clocks on all of the domain controllers in the forest from the PDC Role Owner of the root domain, it is recommended that the domain controller be configured to synchronize its time with an external time source. This alert is active if the root domain PDC Owner is not so configured.

Resolution

Use the w32time command at an elevated PowerShell session to configure the PDC Role Owner to use an external time source.

w32tm /config /manualpeerlist:TimeSource /syncfromflags:MANUAL

Where TimeSource is one or more NTP servers noted by DNS or IP address. When TimeSource is a list of time servers the list must be enclosed in double quotes and each entry must be separated by at least one space. Some examples are listed below:

w32tm /config /manualpeerlist:pool.ntp.org /syncfromflags:MANUAL

w32tm /config /manualpeerlist:”1.pool.ntp.org 2.pool.ntp.org“ /syncfromflags:MANUAL

Objects exist in the Lost and Found container

Description

The Active Administrator® Foundation Service (AFS) periodically checks to see if there are any objects in the Lost And Found container in the domain. If there are, the DC Agent will issue an alert.

During the replication process, Active Directory® may encounter orphaned objects, which are objects that have no parent container. For example, a user deletes container X on domain controller A, and another user modifies object Y contained in container X on domain controller B. During replication, domain controller A will receive an update operation for an object that has no container because container X was deleted. In this case, the directory system agent (DSA) on domain controller A puts the object in the Lost And Found container.

The DSA will place objects in the Lost And Found container as part of its normal operation. However, serveral Lost And Found objects may indicate a replication problem, or at least the deletion of a container that should not have been deleted.

Resolution

Inspect the objects in the Lost And Found container of the replica indicated in the alert using an appropriate utility. Move the objects to an appropriate container or delete them from the Lost And Found container.

PDC operations master inconsistent

Description

The Active Administrator® Foundation Service (AFS) periodically checks the consistency of the domain PDC operations master value across all of the domain controllers in the domain. If any of the domain controllers has a differing value for the domain PDC operations master, an alert is issued.

The domain PDC operations master is contained in the fSMORoleOwner property of the domain object itself. Every domain controller in the domain has a copy of the domain PDC operations master.

The domain PDC operations master determines which domain controller in the domain is responsible for acting as a downlevel primary domain controller (PDC). If the domain PDC operations master is inconsistent, it is possible that two different domain controllers will act as the PDC, with potentially disastrous consequences.

The domain PDC operations master can become inconsistent because an administrator used NTDSUTIL.EXE to move the operations master when there was incomplete connectivity to all domain controllers in the domain. It can also occur because of replication errors.

Resolution

Wait to see if the error clears. An inconsistent operations master alert can be transitory in nature. If an administrator has moved an operations master to another domain controller, replication to all domain controllers in the domain can take some time. During this period, Active Directory Health Analyzer will indicate this alert condition.

If alert does not clear, contact your Microsoft Windows support representative.

Related article

https://blogs.technet.microsoft.com/mempson/2007/11/08/how-to-find-out-who-has-your-fsmo-roles/

© ALL RIGHTS RESERVED. 使用条款 隐私 Cookie Preference Center