• Replies 1 reply
  • Subscribers 20 subscribers
  • Views 2047 views
  • Users 0 members are here
Options
Related

Need to understand the behavior of ADHooks property value from WMI class "Win32_PerfFormattedData_CAAD_ChangeAuditorforActiveDirectory"

a630219
over 3 years ago

I observed that Change Auditor agent on Domain Controller doesn't pass ADEvents to Change Coordinator server even though the Agent service is running on the Domain Controller and it's passing other events too, It shows ADEevents zero on ServiceStatusTray utility on Domain Controller even we make a change in Active Directory object and at the same time it is showing that the registry events are being sent and increasing.

So I wanted to monitor the status of this problem and came across "Win32_PerfFormattedData_CAAD_ChangeAuditorforActiveDirectory" WMI class which has the ADHooks property and it get increased when agent on Domain Controller pass the AD events to CA Coordinator server. 

Now I want to understand the behavior of ADHooks property value, like when it set to zero?, can it be zero in case of inactivity on the Domain Controllers?, when it reset itself?

---------------

Get-WmiObject Win32_PerfFormattedData_CAAD_ChangeAuditorforActiveDirectory| select AD*

 

ADDeniedEvents         : 0

ADDeniedEventsPersec   : 0

ADDeniedHooks          : 1

ADDeniedHooksPersec    : 0

ADEvents               : 0

ADEventsPersec         : 0

ADExcludedEvents       : 0

ADExcludedEventsPersec : 0

ADExcludedHooks        : 0

ADExcludedHooksPersec  : 0

ADHooks                : 73

ADHooksPersec          : 0

ADProtectEvents        : 0

ADProtectEventsPersec  : 0

ADProtectHooks         : 0

ADProtectHooksPersec   : 0

ADQueueLength          : 0

  • over 3 years ago

    I can't speak to the specifics of that counter but I can share some experience with agent problems associated with the "AD hooks".

    Check the agent side logs to see if the AD hooks are being blocked from initializing.  There's some pretty recognizable messages around this.

    If yes, start looking at endpoint protection - Defender, Cisco AMP etc.  Are any of these present on your DC and possibly been recently updated?

    I would also check the Coordinator log to see if by chance, your Change Auditor for AD license is not being recognized.

    'Hope this helps.