Dell Active Administrator 8.0

What s new in Dell Active Administrator 8.0 January 2016 Dell Active Administrator 8.0 is the upcoming release of Dell Software's complete solution for managing Microsoft Active Directory security auditing, delegation, GPOs, accounts, recovery, and health. This document provides a highlight of these improvements. NOTE: The Certificate Management, Azure Active Directory, DNS Management, and Active Directory Health modules each require a license in addition to the license for Active Administrator. The Spotlight for Active Directory Suite license is required for Active Directory Health. This document highlights key features new in this release. For more information about these or any features, see the User Guide. Active Directory Health Spotlight on Active Directory Diagnostic Console What s new in Search Edit more user attributes from search results Use wildcards when searching for Active Directory objects What s new in Security & Delegation Execute custom programs or scripts on inactive accounts What s new in Auditing & Alerting Notify users for audit agent deployment View reports scheduled by other users Use Full-Text Search to filter event descriptions Export audit reports to table format What s new in DNS Management Edit DNS records from search results Edit DNS server properties Scavenge records What s new in Certificates Generate reports on certificates Exclude certificates from SHA-1 notifications Install certificates on multiple servers Install PFX (PKCS #12) files Cancel the add computer process Check for revoked certificates 1

What s new in DC Management Save domain controller System Event logs What s new for Configuration Support for Windows 10 Filter system events for the Active Administrator Foundation Server Enable and disable verbose logging on the Active Administrator Foundation Server Use a service connection point for the Active Administrator server Migrate data from one database to another Active Directory Health The new Active Directory Health module proactively monitors and troubleshoots Active Directory. The Active Administrator Foundation Service (AFS) and the Directory Analyzer agent continuously analyze Active Directory and alert on error conditions to help you maintain a healthy stable environment. IMPORTANT: The Spotlight for Active Directory Suite license is required for the Active Directory Health module. Analyze The Analyze feature displays read-only real-time data. The data on the screen you are viewing is refreshed automatically every minute by default. Data is organized into tabs and differs depending on the item you select. For example, the data you can view on a selected domain controller includes the following tabs: Summary Displays overall information about the selected managed domain controller, including the server name, version, up time, last updated, last refreshed, and performance counters. Each performance counter displays a sparkline, which is a visual representation of the data collected in the indicated time frame. You can view trends and a full chart of the performance counter. Services Displays all services and their status. Services that are not running display at the top of the list. If a service is running, but has stopped at a point in time, that stoppage is indicated with red. Server Displays information about the logical disks on the domain controller and the network adapter, such as the description, the file system, memory usage, disk drive usage, network time and server, memory and disk statistics, network adapter and IP addresses, and subnet masks. Active Directory Displays server information, SysVol shared status, NetLogon shared status, the number of available RIDs, Active Directory database information, SysVol details, and LDAP response time. Current Alerts Displays the current alerts for the selected forest, domain, or monitored domain controller. A count of the current alerts displays in the upper right-hand corner. The Summary tab displays the total number of alerts. Applications Displays installed applications on the selected monitored domain controller. Applications installed or removed in the last 24 hours are listed in a separate pane. Updates Displays installed updates on the selected monitored domain controller. Updates installed or removed in the last 24 hours are listed in a separate pane. To view information about the update in the default web browser, double-click the update. You can view data on the forest, sites, domains, and domain controllers. By monitoring the alerts that display, you can quickly address problems and keep Active Directory healthy. 2

Agents To monitor Active Directory domains, an agent is required. You can install the agent on each domain controller that you want to monitor, which is called standalone mode. You also have the option to install the agents on servers in a pool that are used to monitor selected domain controllers. Installing the agents into a pool balances the workload among the servers in the pool. As domain controllers are added, removed, stopped, or started, the servers automatically adjust the workload. So, if one agent stops, another agent automatically picks up the workload and continues. Using the agent pool is the best way to keep your operation running. By default, an email notification is sent when an agent goes into a critical state, a stopped state, and when the agent has recovered. You also can select to send an email notification when the agent goes into a warning state or when an agent workload evaluation is performed. Alerts Directory Analyzer alerts have two levels of severity: warning and critical. As a situation escalates, a warning alert is generated, indicating that a lower priority threshold has been violated. As the severity of the error increases, a critical alert is generated, indicating that the higher priority threshold has been exceeded. A number of attributes can be customized for each of these levels, including the threshold value, duration before an alert occurs and duration before an alert clears. There are two ways to view alerts. You can view current alerts for selected forests, domains, sites, and domain controllers while using the Analyzer feature. The Alerts feature displays all the current alerts and alert history. You also can generate an alert history report to send to recipients through email or save the report to a file. You can create notifications to send to specified email recipients. A wizard helps you create multiple types of notifications to address varied audiences and their specific needs. For example, you might send only site alerts on a selected site to a certain user. Troubleshooter You can run reports, jobs, and replicate data from one domain controller to another. Replication View provides valuable information about the two domain controllers selected for data replication. The information consists of the immediate replication partners for the target server and the recommended replication path between the two servers. From the Replication View, you can also initiate an end-to-end data replication for these domain controllers. Table 1. Directory Analyzer reports Report Active Directory Disk Space Bind with RID Master Conflicting Objects Connection Object Duplicates Diagnostic Event Logging Levels Directory Service Parameters Description Lists file locations, page file information, Active Directory file location check, file information, disk usage, and SYSVOL information. Lists the relative identifier (RID) master role and the results of the binding (DSBind) with the selected domain controller. Lists the object and the conflicting object including the date and time of creation. Lists the duplicated connection objects for the selected domain controller. Lists values and descriptions for each event log level for the selected domain controller. Lists directory service configuration parameters from the registry: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters 3

Report Distributed File System Replication Domain Configuration Domain Controller Connection Objects Duplicate SIDs Forest Configuration Replication Failures Replication Logon Privileges Replication Partners Replication Queue Length Description Lists Distributed File System Replication (DFSR) partners, DFSR service information, connection objects, SYSVOL statistics, connectivity tests, and recent event log messages. Optionally, if the DFSR service is not running, you can choose to start the DFSR service on the target domain controller and on its DFSR partners. The default setting is to not start the DFSR service. You also can choose to include details about the files and folders that were moved to the Conflict and Deleted folder due to conflicting updates. NOTE: Requesting details about the files and folders may add considerable time to the report generation. Lists domain role holders, Group Policy objects, protected groups, domain administrators, and trusted domains. Lists the connections objects, with details, from the domain controllers that are used during replication. Lists duplicate SIDs for the selected domain controller. Lists enterprise role holders, domain partitions, and Group Policy counts. Lists the results of replication operations for every naming context and every replication partner. Checks that logon privileges are appropriate for replication. Lists information about inbound and outbound replication partners for the selected domain controller. Lists the length of the queues for current and pending replication tasks. Table 2. Directory Analyzer jobs Job Enable or disable domain controller replication Set directory service log levels Set NetLogon parameters Set startup and recovery options Start metadata cleanup Start online defrag Description Enables or disables inbound and outbound domain controller replication on all domain controllers in a selected forest or domain. By default, Active Directory records critical and error events (log level 0) in the directory service log in Event Viewer. Run this job to set the log level in Active Directory. As you increase the setting, more events are recorded for the event type, with log level 5 recording all events. View and/or modify the current settings for the parameters set for the HKEY_LOCAL_MACHINES\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters registry key. A wizard guides you through modifying the boot configuration for the selected managed domain controller running Windows Server 2008 and greater. When a server is promoted to a domain controller, configuration data is added to Active Directory. When the domain controller is demoted successfully to a member server, the configuration data is removed. If the demotion is unsuccessful, the configuration data remains. Run this job to remove the configuration data. To optimize the Active Directory database, periodically run online defragmentation to redistribute data and free disk space for the database to use. The size of the database does not shrink. Optionally, you can run garbage collection prior to online defragmentation to remove tombstones, which are remains of objects that were deleted, and to delete unnecessary log files. 4

Spotlight on Active Directory Diagnostic Console Active Administrator now incorporates Spotlight on Active Directory Diagnostic Console, which is a powerful diagnostic and resolution tool. Its unique user interface provides a real-time representation of the dataflow in your forest, allowing you to detect, diagnose, and resolve Active Directory problems. Spotlight on Active Directory Diagnostic Console offers expert help that explains each process and counter on a domain controller, and what a raised alarm means. The help system offers suggestions on how to resolve the alarm, common solutions, and next steps. Graphical flows illustrate the rate at which data is moving between domain controller components. Components display the value of key statistics and metrics. The power of Spotlight on Active Directory Diagnostic Console lies in its ability to provide visual and audible warnings if performance metrics exceed acceptable thresholds. Components change color to show you the source of the problem. A range of reports and graphs provide you with detailed information about a domain controller. This information can be viewed on the screen, or printed. What s new in Search Edit more user attributes from search results When editing user attributes from user search results, you now can add or edit the division, employee ID, and direct reports of the selected user. Use wildcards when searching for Active Directory objects You now use the * wildcard character when searching for Active Directory objects. Click Search, and type a string in the Search for users, computers, groups, etc. box, using the * wildcard character as needed. What s new in Security & Delegation Execute custom programs or scripts on inactive accounts You now can choose to execute a program or script on inactive user and computer accounts (Security & Delegation Inactive Accounts Users & Computers). You specify the program or script and the working folder (a local path on the Active Administrator server) in which to execute the program or script. If you do not specify a working folder, the working folder becomes the System directory on the Active Administrative Server. You also can use the Script arguments option to build an argument by selecting parameters from a list. 5

What s new in Auditing & Alerting Notify users for audit agent deployment Active Administrator offers automated agent deployment(auditing & Alerting Agents Auto Deployment), which installs the audit agent automatically when a new domain controller is detected. With version 8.0, you now have the option to just notify users of the newly detected domain controller so they can install the audit agent manually. View reports scheduled by other users By default, only the schedules for that you create are listed when you view Active Administrator report schedules (Auditing & Alerting Audit Reports Scheduling Scheduled Reports). If you also want to see the schedules created by other Active Administrator users, select the Show scheduled reports for all users check box in Settings User Options. Use Full-Text Search to filter event descriptions If you have a large database, filtering event descriptions for specific text can take a long time, but you can now use the Full-Text Search in SQL Server to speed up the process. You need to enable Full-Text Search in SQL Server, and then in Active Administrator. Export audit reports to table format You can now export audit reports into an easy-to-use table format. What s new in DNS Management Edit DNS records from search results You now have the ability to edit or delete DNS records directly from the search results. Select DNS DNS Search, perform a search, select a result, and click Edit or Delete DNS object(s). You can delete individual records or a selection of records. Edit DNS server properties You can edit most properties of a DNS server. Select DNS DNS Management, select a DNS server from the list, and click Properties. You can set aging/scavenging properties; edit the State of Authority (SOA) record; and add, edit, or remove name servers. Scavenge records Stale resource records can degrade the performance of a DNS server over time. Now you can run scavenging on demand or set up automatic scavenging in DNS properties. 6

What s new in Certificates Generate reports on certificates You now can generate reports on certificates, including those certificates in the repository. Select Certificates Certificate Repository, and click Report. The reports can include all certificates, or just those about to expire, those that are expired, and those that need replacing. You can sort by HASH, so you easily can see those certificates that require management. Exclude certificates from SHA-1 notifications By default, if a certificate supports SHA-1 cryptography, an email notification is sent. You can exclude a selected certificate from being included in the notification. This also applies to the Certificate Repository. Install certificates on multiple servers In previous versions of Active Administrator, you could select only one computer when installing certificates. In version 8.0, you can now select multiple servers when installing certificates. Install PFX (PKCS #12) files Personal Information Exchange (PFX) files contain both the public and private key and most always require a password. With Active Administrator 8.0, you can now easily install PFX files on other computers directly from the Certificate Management window. Cancel the add computer process Active Administrator validates each computer before adding it to the list for certificate monitoring. If you selected several computers to add and the process is taking too long or you are getting errors, you can now cancel the process. Check for revoked certificates By default, if a certificate is revoked, an email notification is sent. You can exclude a selected certificate from being included in the notification. You also can create a report of revoked certificates to send in an email to specified recipients. What s new in DC Management Save domain controller System Event logs When clearing system event logs in the DC Management module (DC Management Event Logs), you now have the option to save the log before clearing it. The log contents are saved to an Event file (*.evtx), which you can view using the Windows Event Viewer. 7

What s new for Configuration Support for Windows 10 Active Administrator Console can be installed on a computer running Windows 10. Filter system events for the Active Administrator Foundation Server When examining system events for the Active Administrator Foundation Server (AFS), you can choose what information to display and filter the results by a variety of criteria. Select Settings AFS Server Status General tab, and click to display the list of filters. On the System Logs and System Errors tabs, you can start typing in the Filters box and the list filters as you type. Enable and disable verbose logging on the Active Administrator Foundation Server You can enable/disable verbose logging of the Active Administration Foundation Server (AFS). Verbose logging can impact performance, so you should disable it when it is not needed for troubleshooting. Select Settings AFS Server Status General tab, and click to expand the display. Click the Disable Verbose Logging button to turn off verbose logging. When you need it for troubleshooting, click Enable Verbose Logging. Use a service connection point for the Active Administrator server Now when you first start Active Administrator, an available server is located automatically so you no longer need to identify a server name and port. By default, the option to use service connection points is enabled. If you do not want to use connection points when setting the Active Administrator server, select Settings User Options General tab and clear the check box. You also can set the specific connection point to use, as well as the server and port by selecting Settings AA Server. Migrate data from one database to another The Dell Active Administrator Database Migration Tool helps you migrate data quickly and efficiently from a source database to a target database within the same version of Active Administrator. For example, you created a new Active Administrator database and want to copy custom reports and alerts from an existing database. Use the AA Database Migration Tool, which is located off the Start menu, to copy the existing data to your new database. 8

About Dell Dell listens to customers and delivers worldwide innovative technology, business solutions and services they trust and value. For more information, visit http://www.software.dell.com. Contacting Dell For sales or other inquiries, visit http://software.dell.com/company/contact-us.aspx or call 1-949-754-8000. Technical support resources Technical support is available to customers who have purchased Dell software with a valid maintenance contract and to customers who have trial versions. To access the Support Portal, go to http://support.software.dell.com. The Support Portal provides self-help tools you can use to solve problems quickly and independently, 24 hours a day, 365 days a year. In addition, the Support Portal provides direct access to product support engineers through an online Service Request system. The Support Portal enables you to: Create, update, and manage Service Requests (cases) View Knowledge Base articles Obtain product notifications Download software. For trial software, go to http://software.dell.com/trials. View how-to videos Engage in community discussions Chat with a support engineer 9

Copyright 2016 Dell Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. Dell, the Dell logo, and Spotlight are trademarks of Dell Inc. in the United States and/or other jurisdictions. Microsoft, Windows Azure, Azure, SQL Server, and Active Directory are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. All other marks and names mentioned herein may be trademarks of their respective companies. Legend CAUTION: A CAUTION icon indicates potential damage to hardware or loss of data if instructions are not followed. WARNING: A WARNING icon indicates a potential for property damage, personal injury, or death. IMPORTANT, NOTE, TIP, MOBILE, or VIDEO: An information icon indicates supporting information. 10