Information Centric Analytics (ICA) can be integrated with Active Directory (AD) to map users, groups, and computers to events from other data source integrations. When integrated, ICA's Active Directory Connector Utility executes Lightweight Directory Access Protocol (LDAP) queries against one or more domain controllers and stores the output in the ActiveDirectoryDW database hosted in Microsoft SQL Server for retrieval during the nightly RiskFabric Processing job run. The Active Directory Connector Utility can be run manually from a command line or scheduled to run programmatically by the SQL Server Agent as part of the Bay Dynamics AD Connector Job.
The duration of this job can vary significantly between environments based on a number of factors, including: the number of integrated domain controllers; the metadata attributes and containers enabled for each connection; the number of records returned by each domain controller; network latency; and the performance of disk I/O, RAM, and other system resources on both the domain controller(s) and the server hosting the ActiveDirectoryDW database.
The SQL Server Agent's Job Activity Monitor will report on the status of the Bay Dynamics AD Connector Job. If it reports the job is running longer than expected, the following method can be used to determine whether the importer is still running:
Get-Content <path to the AD Connector Utility>\logs\ImportAdUsersAndComputers.<yyyyMMdd.log> -Tail 1 -Wait
When the job completes, you will see output similar to the following:
2023-07-13 20:00:01,133 ImportADUsersAndComputers.exe [1:INFO] DataAccess.Merge() GroupMembersComputers - merge successful, 0 records affected
2023-07-13 20:00:01,133 ImportADUsersAndComputers.exe [1:INFO] Program.Main() Run successfully completed
You can also query the staging tables in the ActiveDirectoryDW database to determine whether new records have been inserted. To query these tables, follow this procedure:
SELECT COUNT(*) AS "Records" FROM ActiveDirectoryDW.dbo.stg_User WITH (NOLOCK);NOTE: This query can be modified to query the tables dbo.Stg_Computer, dbo.Stg_Group, etc.