How to monitor active directory

I’m trying to monitor the health of my AD (seems a rather obvous thing to do), the only plugin i have found is https://exchange.nagios.org/directory/Plugins/Operating-Systems/Windows/Active-Directory-(AD)-Check/details and a rather old vb-script.
Is there anything better or can someone tell me how to get that script running on my Agent?
It works on the shell but with the added abstraction of director and me only using basic windows agent checks so far i got no idea how to configure it.

PS: I was able to add custom checks for my linux boxes just fine, but it seems i have to use NRPE for that …?

It is the best choice to monitor the AD.

We use the NSClient to use this plugin and NRPE as daemon.

https://icinga.com/docs/icinga2/latest/doc/07-agent-based-monitoring/#nsclient

Don’t use NRPE, that’s discouraged for security reasons (and others). Use the Icinga agent as command endpoint.

Depending on your Windows agent, I would recommend to look for Powershell scripts, or write your own. vbs “works” but who knows for how long, and it also has limited capabilities with system access. E.g. this. You can run the PS scripts directly with the Icinga Agent on Windows, refer to this howto: Windows PowerShell Checks with Icinga2

Cheers,
Michael

1 Like

Yes, noticed the warning about NRPE too …
Got powershell checks working with your nice howto, now i just need to figure out why the ps script to check ad replication only woks on ONE of my two domain controllers lol.
Thanks.

Note:
The script from https://exchange.nagios.org/directory/Plugins/Operating-Systems/Windows/AD-Replication-Check-(with-performance-counters-from-DRA)/details worked on one DC on the other the counters had different Path names (“DirectoryServices(NTDS)” as opposed to “NTDS”) sigh patched the script, works now …

Maybe you create a GitHub repository for the patched plugin and sync it to https://exchange.icinga.com? That way others can benefit from your solution as well :slight_smile: