Skip to main content
The Active Directory module captures the directory itself—not the systems in it. It addresses no individual targets: the wizard requires the domain and an account allowed to read it, nothing else. The wizard shows four steps for this module: Basics › Domain › Schedule › Summary All but Domain are the same for every module—see Creating a Scan Job. A connected gateway is required.

​
Prerequisites

​
Ports and protocols

​
Permissions

A complete scan requires an account with domain administrator rights. Enter it as DOMAIN\user or user@domain.local. A regular domain user is sufficient as long as the default configuration of Active Directory has not been changed. The configuration partition and the BitLocker recovery keys are then missing: the class msFVE-RecoveryInformation is reserved for domain administrators. To capture BitLocker recovery keys without a domain administrator, set up a delegation: create a security group, grant it permissions on the msFVE-RecoveryInformation objects through object management, and add the scan account to the group. If the scan runs without credentials of its own under the gateway’s service account, that account needs the same rights.

​
Network requirements

  • The firewall allows the ports above.
  • The domain is entered with its FQDN, such as docusnap.intern.
If the gateway cannot reach a domain controller, scan the directory locally on a domain controller with the Discovery-ActiveDirectory.exe scan script—see Scanning by Script.

​
Domain and credentials

The Domain step takes the Domain first and the Windows credentials below it. If the domain field is visible, it must be filled. You choose the credentials in a searchable picker. In first position stands the entry that lets the scan run under the gateway service’s account. Two rows above it create a new entry: New Credentials… a reusable one, One-Time Credentials… one that applies to this job only.
For Active Directory and Windows (AD), the entry for the gateway service’s account counts as an answer; the wizard does not let you leave the step without any choice. Whether the scan succeeds under that account depends on which account the gateway service runs under in your network. For the first job an explicitly stored account is advisable.

​
Active Directory Options

The Domain step contains the Active Directory Options section. Customize opens two checkboxes; next to the button you see how many of them are selected, by default 2 of 2 selected.
Both checkboxes are selected by default. A job captures personal data and extended attributes of the directory unless you clear the checkbox. The decision is made in the wizard, not later on the captured data.

​
Common issues

  • Windows (AD) fetches the systems from the same directory instead of capturing the directory—see Windows. The two jobs complement each other.
  • Windows DNS, Windows DHCP and DFS can have their targets searched for in Active Directory instead of having them typed in.
  • NTFS Security discovers its servers through the directory and needs domain and credentials for that as well—see NTFS permissions.
Which types this scan produces is under Directory and Network Services. How you watch the job afterwards is in Managing Jobs.