Active Directory
3 minute read
To start the wizard for inventorying the Active Directory service, either click the Network Scan button or the Active Directory button. The Active Directory step will be displayed after you have selected a company and a domain and entered your credentials (see: Basic Steps).
Select OU
Using the Start Search at filter criterion, you can restrict the AD scan to a specific organizational unit. Click the Select OU button to open a dialog where you can select the desired organizational unit. To display the inventoried objects in the Active Directory structure, the parent structure of the selected organizational units is also inventoried. If you do not enter a filter criterion, Docusnap will inventory the entire Active Directory system.
Advanced Options
In the Advanced option you can, by enabling the checkbox Scan Structure Permissions, determine whether the permissions for an Active Directory object should be inventoried. It can also be determined whether the sites and the domain structure should also be inventoried.
The Analysis in IT Security requires a complete Active Directory inventory of users, groups and computers to be completely correct. Thus you can determine for the Active Directory inventory, that users, groups and computers of all organizational units will be scanned, even if a filter for a specific organizational unit has been defined. Once an organizational unit has been set, the Inventory all Users, Groups and Computers checkbox will be displayed in the Advanced option for this purpose.
Group Policies
Group Policy settings are read and displayed for the corresponding organizational units or the domain. The prerequisite for this is a system with the Group Policy Management Console (GPMC) installed. The technical settings of each Group Policy are captured and displayed hierarchically, so they can be analyzed, documented across all GPOs, and made available through corresponding reports. The group policies appear in two areas:
- AD Structure – for each organizational unit, the group policies linked to that OU.
- All GPOs – a flat list of all GPOs in the domain, including unlinked GPOs. Two views are available for each GPO: the Data tab with the structured settings and the GPO Configuration tab with the HTML view of the policy.
Active Directory Classes
In the Active Directory Classes group, you can select the Active Directory classes to be included in the scan.
BitLocker recovery keys stored in Active Directory are included in the Active Directory inventory and are displayed as nodes in the inventory result for the respective computer account. If the BitLocker recovery key should not be a part of the inventory, the BitLockerRecovery class can be excluded.
Domain Controller
With every Active Directory inventory, the name of domain controller from which the inventory data was scanned is also stored. This domain controller is displayed in the Explorer with the scan date.