Force Re-Enumeration of all AD objects with ADmon?

[Jason]

From my understanding, ADmon will pull down all objects in AD on first run, then only report changes from then on. However, the original baseline data will get lost when it ages out of an index.

Is there a way to force ADmon to re-enumerate all AD objects to get a proper baseline, occasionally?

[rgopalan · Accepted solution]

You could do one of the following to re-sync the events from the server.

i) Manually add another stanza in etc\...\local\admon.conf like so:

[newCollection]
targetDc = "your Server here"
startingNode = 
monitorSubtree = 1
disabled = 0

ii) Use Splunkweb to add the new collection with the same settings as the old one.

iii) In the splunk directory, under var\lib\splunk\persistentstorage\ADMon there is a file called "your collection name here.ini". Deleting this file before restarting splunk-admon.exe will resync the data from the server. If there are multiple such files, pick the file pertaining to the collection you want to reenumerate.

[helge]

Should it not be "inputs.conf" instead of "admon.conf"?

[maraman_splunk]

Yes

method 1 worked for me :
modify input app deployed on UF locally on AD :
in inputs.conf
change the admon collection name [admon:collection2]
used baseline=1
disabled=0
targetDC = "myAD"
index=myindex
monitorSubtree=1

push to uf
then wait for baseline to complete
then change baseline to 0 and repush to uf

This way is easier when you don't have local access on the AD to clean up files

[helge]

Deleting the INI files is the way to go!

[Jason]

I have not been able to test this, but am going to mark this as accepted. If anyone is able to test this, please comment!

[Jason]

(Without completely clearing fishbucket.)