Deploying the Active Directory Adapter

To deploy the Active Directory Adapter, perform the following steps:

1. Create Active Directory credentials with the appropriate permissions

You can connect Axonius to Active Directory using a Service Account with a username and password or via Kerberos

2. Set up the Active Directory adapter in Axonius

Create the Adapter connection in Axonius. Based on the authentication method (Service Account or Kerberos), fill out the specific fields and configure optional settings.

Add a New Connection

1. From the Adapters page, search for Microsoft Active Directory(AD) and select the adapter.
2. Click Add Connection. The Create Connection drawer opens on the Connection Configuration tab.
3. Fill in the sections below, then save the connection.

To check that Axonius can reach the source before you enter credentials, click Check Network Connectivity. For more details, see Adding a New Adapter Connection.

Environment

The instance this connection reads from.

1. DC Address (required) - Specify the IP address of a single domain controller, or an FQDN that resolves to a single domain controller in an Active Directory Domain. It is recommended to enter a domain controller with DNS and Primary (PDC) roles.
2. Port
   • Service Account - LDAPS (LDAP over SSL): 636 (LDAPS default, refer to the Required Ports table if you setup differently)
   • Service Account - LDAP: 389 (LDAP default, refer to the Required Ports table if you setup differently)
   • Kerberos: 88 (Kerberos default, refer to the Required Ports table if you setup differently)
3. Fallback DC Address, Fallback Port - Enter a secondary DC address and port as a secondary server to be connected if the first one fails.

Access

How Axonius authenticates to the instance. Select one of the authentication methods.

1. SASL Mechanism (required, default: No SASL) - No SASL
   • GSSAPI - Kerbero's default mechanism. (Realm / Kerberos KDC fields required)
   • External - Authenticate using User Name
   • Digest MD5 - Authenticate using Username, Password, Enable signing, and Realm Authorization ID (Realm / Authorization ID (authzid) fields required)
   • Plain - Authenticate using Username/Authentication ID and Password and Authorization ID (Authorization ID (authzid) fields required)

1. Username and Password (required) - A Service Account with appropriate permissions and its password.

   • Username format - username@domain OR domain\username

   Note:

   When connecting over SSL, the username must be in the format username@domain

2. Use SSL for connection (default: Unencrypted) -
   • Verified - The DC Address above must be the FQDN provided by the certificate.
   • Unverified - (not recommended for production environments) Skips certificate verification
3. CA file - To use LDAPS, you must upload an SSL certificate in PEM format
4. SSL cipher - Enter an SSL cipher to use for the TLS object of the connection. Using a stronger cipher can solve connection failures when using the default cipher. Examples of OpenSSl ciphers

Scope

1. Connect to Global Catalog (GC) - Select this option if the configured DC has a Global Catalog role.
2. Organizational units include list - To ensure Axonius fetches entities only from specific organizational units (OUs), input the desired OUs using their distinguished names (DNs). Each entry in the list should correspond to a separate OU. For example, if you want to include the organizational units for Acme Corporation in both the Ireland and New York Offices, specify them as follows:
   • Ireland Office/Acme/Corp,New York Office/Acme/Corp
3. Organizational units to exclude - To prevent Axonius from fetching entities belonging to specific organizational units (OUs), list the OUs using their distinguished names (DNs). Each entry in the list should correspond to a separate OU. For instance, if you want to exclude the organizational units for Acme Corporation in both the Ireland and New York Offices, specify them as follows:
   • Ireland Office/Acme/Corp,New York Office/Acme/Corp
4. Search Base - Search Base: This field specifies a path for conducting searches within a defined scope. By default, searches are conducted across the entire domain. However, configuring this option can be beneficial when dealing with multiple Active Directory (AD) subdomains, as it allows you to limit the search to resources within a specific subdomain.

More Options

1. DNS Server Address - Axonius assumes that Domain Controller listed in each connection is also a DNS server. If your Domain Controller does not have the DNS role installed and you would like to use a different system for name resolution of discovered assets you can enter an alternate IP address here (even if it is installed, but you enter a field here, Axonius will use it). Please note that this setting is only used for discovered assets and will not affect resolution of the Domain Controller name entered in the connection configuration. This configuration value is used in conjunction with the Enable IP Resolving advanced setting.
2. Alternative DNS suffix - Replace the device original DNS suffix for DNS resolving. For example, if the device name is windows8.acme.corp , and the Alternative DNS Suffix defined is 'acme-corp.lan', DNS resolving will be done for windows8.acme-corp.lan.
3. Do Not Fetch Users - Select this option if you do not want to fetch users
4. Fetch Disabled Devices and Fetch Disabled Users - Select to fetch disabled devices or users. By default, Axonius fetches only enabled devices and users.
5. Filter Deleted Devices - By default Axonius fetches deleted devices. Select this option to not fetch deleted devices.
6. Filter Deleted Users - By default Axonius fetches deleted users. Select this option to not fetch deleted users.
7. HTTPS Proxy - A proxy to use when connecting to the value supplied in Root Domain.
8. HTTPS Proxy User Name (optional, default: empty) - The user name to use when connecting to the value supplied in Root Domain via the value supplied in HTTPS Proxy.
9. HTTPS Proxy Password - The password to use when connecting to the value supplied in Root Domain via the value supplied in HTTPS Proxy.

10. Select Gateway – Select the Axonius Gateway to use when connecting adapters whose sources are only accessible by an internal network and not from the primary Axonius instance, which may be an Axonius-hosted (SaaS) instance or Customer-hosted (on-premises / private cloud). To use this option, you need to set up an Axonius Gateway.

Required Ports

Axonius must be able to communicate with the address supplied in DC Address using one of the following ports:

3. (optional) Configure Advanced Settings

Refer to the Active Directory Advanced Settings.