Getting Started with Active Directory On-Demand Assessment

The Active Directory Assessment provides you with an assessment of your Active Directory Environment with domain controllers running on-premises, on Azure VMs, or on Amazon Web Services (AWS) VMs. The analysis generates a list of issues to address with remediation guidance and best practices to improve the performance of Active Directory infrastructure and features such as deploying applications, software updates, and operating systems. Assessments are available through the Services Hub to help you optimize the availability, security, and performance of your Microsoft technology investments. These assessments use Microsoft Azure Log Analytics, which is designed to give you simplified IT and security management across your environment.

This assessment is designed to provide you specific actionable guidance grouped in Focus Areas to mitigate risks to your Active Directory and your organization.

The Active Directory Assessment focuses on several key pillars, including:

• Operational processes
• Active Directory Replication
• Site Topology and Subnets
• Name Resolution (DNS)
• Domain Controller Health
• Active Directory Database
• SYSVOL and Group Policy Health
• Account Information and Token Size
• OS Information and Networking
• Windows Time Configuration

Running the Active Directory Assessment

Prerequisites

In order to take full advantage of the On-Demand Assessments available through Services Hub, you must:

1. Have linked an active Azure Subscription to Services Hub and added the AD Assessment. For more information please read the Getting Started with On-Demand Assessments article or watch the how to link video.

2. Have a domain account (User or Managed Service Account) with the following rights:
   

   • Enterprise Administrator
     
   • Administrative access to every domain controller in the forest
     
   • Administrative access to all Microsoft Domain Name System (DNS) servers that the domain controllers participate with
     
   • Administrative access on the data collection machine
     
   • Log on as a batch job privileges on the data collection machine
     

3. Review the Pre-Requisites document for the AD Assessment . This document explains the detailed technical documentation of the AD Assessment and the server preparation needed to run the assessment. It also documents the different types of data collected by the assessment.

Note: On average, it takes two hours to initially configure your environment to run an On-Demand Assessment. After you run an assessment you can review the data in Azure Log Analytics. This will provide you with a prioritized list of recommendations, categorized across six focus areas. This allows you and your team to quickly understand risk levels, the health of your environments, act to decrease risk, and improve your overall IT health.

Setup the AD Assessment on the data collection machine

Note: You will only be able to successfully setup the assessment once you have linked your Azure Subscription to Services Hub and added the AD Assessment from IT Health -> On-Demand Assessments in Services Hub.

1. On the data collection machine, create the following folder: C:\OMS\AD (or any other folder besides C:\ODA which is reserved by the system)

2. Open regular Powershell (not ISE) in Administrator mode and run the below cmdlet:

Add-ADAssessmentTask -WorkingDirectory' command

WorkingDirectory is a path to an existing directory used to store the files created while collecting and analyzing the data from the environment

Workspace Id – provide id for the Log Analytics workspace that will be used to store the uploaded data

3. Provide the required user account credentials that satisfy the requirements mentioned in this article earlier

4. Data collection is triggered by the scheduled task named ADAssessment within an hour of running the previous script and then every 7 days. The task can be modified to run on a different date/time or even forced to run immediately from the Task Scheduler library, Microsoft folder, Operations Management Suite, AOI***, Assessments, then ADAssessment.

5. During collection and analysis, data is temporarily stored under the Working Directory folder that was configured during setup.

6. After a few hours, your assessment results will be available on your Log Analytics and Services Hub Dashboard. You can navigate to see the results by going into Services Hub -> Health -> Assessments and then clicking on "View all recommendations" against the active assessment.

7. If you wish to get a Microsoft Accredited Engineer to go over the issues about your AD Environment with you, you can contact your Microsoft Representative and ask them about the Remote or Onsite CE Led Delivery.

   agreement	Remote Engineer	Onsite Engineer
   Premier	AD Remote Datasheet	AD Onsite Datasheet
   Unified	AD Remote Datasheet	AD Onsite Datasheet