Splunk App for Active Directory - ADMON

[splunk68]

Hello,

I'm implementing Splunk App for Active Directory with Universal Forwarders, and carefully enabling step by step (event logs, powershell scripts, perfmon, and so on...) without troubles so far except for one area: ADMON.

I'm looking for following hints about ADMON:

• should it be activated on all Domain Controllers or is it enough on the master ? (to avoid too much traffic on WAN links)
• is it performance consuming for the Domain Controller where it's enabled ?
• which events/data are collected by ADMON ?

These are the information I'd rather know before activating it on productive domain controllers.
Any hint would greatly appreciated, thanks !

[jgigliotti]

Hi, if ADMON collects changes only to ad as you have pointed out (changes to user, group, machine, and group policy objects) then these changes would be replicated throughout all other DC's in the domain so what would be the reason to have it running on all DC's?

Why I ask is that we had an issue on our Domain where we were recommended the following as per Adrian Hall’s Blog: http://blogs.splunk.com/2014/01/27/working-with-active-directory-on-splunk-universal-forwarders/

[jbernt_splunk · Accepted solution]

ADmon should be enabled on all domain controllers forwarding in data.
The performance related to ADmon is negligible, unless you have thousands of events per second or more. The WMI calls in the PowerShell scripts consume more resources, but even then after the initial upload, these quiet down quit a bit as well.
The events and data that ADmon is collection, are changes to user, group, machine, and group policy objects. If these are not changing, then admon will be a fairly quiet input.

Thanks,
Jeff.