by two different tools the Active Directory discovered abnormal objects and not really existed?

Question

We are observing an unusual issue during Active Directory discovery. Two different tools (Ivanti Security Controls and Delinea PAM) are retrieving the same results from Active Directory and displaying a large number of unexpected computer objects. These objects do not follow our standard naming convention and appear to have randomly generated names. Additionally, these objects not existed in AD, and the number of discovered objects is significantly higher than the number of valid computer objects that actually exist in the target Organizational Unit (OU).

Answer 1

Hello @eb-cb

The fact that Ivanti Security Controls and Delinea PAM independently return the same unexpected computer objects strongly suggests the results are coming from Active Directory itself, rather than being randomly generated by either product.

I would first determine exactly what type of AD objects they're discovering. Deleted objects can remain in AD as tombstones for a period of time, although normal LDAP searches don't return them unless you use the appropriate deleted-object control.

From PowerShell, compare the discovery results against the actual computer objects:

Get-ADComputer -Filter * -SearchBase "OU=<TargetOU>,DC=<domain>,DC=<com>" `
    -Properties DistinguishedName,ObjectGUID,whenCreated

Then check whether any of the reported names exist as deleted objects:

Get-ADObject -Filter {Deleted -eq $True} -IncludeDeletedObjects

Microsoft confirms that Get-ADComputer can query computer objects by DN, GUID, SID, or sAMAccountName, so comparing the tools' results using ObjectGUID and DistinguishedName, rather than only the displayed computer name, is important.

If the objects don't exist in the target OU or Deleted Objects container, check each domain controller individually. A replication problem can leave lingering objects on one DC even though those objects no longer exist on other DCs. Microsoft specifically recommends checking replication and, when appropriate, using repadmin /removelingeringobjects to identify them.

I would also run:

repadmin /replsummary
repadmin /showrepl *

If both products query the same DC/Global Catalog and the unexpected objects appear there, the issue is most likely AD data/replication or the LDAP discovery scope/filter, rather than an Ivanti- or Delinea-specific discovery problem.

Sharing these references with you:

Microsoft – Lingering objects in an AD DS forest

Microsoft – Get-ADComputer

Microsoft – Deleted Objects container

Please "Accept the Answer" if this information helped you. This will help us and others in the community.