For any organization, Microsoft Active Directory (AD) is an essential component of its IT infrastructure, which uses Microsoft Windows servers or desktops.
It is a reliable, scalable solution to manage users, their accounts and authentication of individual computers, shared drivers, printers, servers and more in any Windows environment.
It runs on Windows Server and enables administrators to manage permissions and access to network resources.
It stores data as objects. An object is a single element, such as a group, application, user, or device (can be a printer). These objects can be computers, printers, security principles, or groups of users.
It is a part of Windows Server operating systems representing a set of services and processes.
It works like any other software tool and has limitations that are difficult to overcome. In fact, Microsoft’s Active Directory has both pros and cons for its users.
It offers bog benefits like organizations can centrally manage all of the user accounts, passwords, access rights, etc. It can also centrally add a new user or revoke an existing user’s permissions.
Because it handles everything centrally, it becomes important to monitor the availability and performance of Active Directory.
It is, thus, essential for system administrators to monitor the availability and performance of Active Directory services round the clock so that they can detect and correct issues in a proactive manner.
In the blog, we will talk about some common challenges with Active Directory and the ways to address them:
Challenge #1. Issues with Group Policy
Group Policy is a boon for system administrators as it allows them to configure and deploy anything in their Active Directory environment. Be it deploying software to configuring the default printer for a system; Group Policies solves them all. The problem arises with bigger organizations that may have many Group Policy rules and exceptions in place. In such a scenario, it becomes difficult for system administrators to keep track of everything. Moreover, if Group Policies are incorrectly set, it may result in logon slowness. Administrators must, thus, determine which Group Policy is causing the slowness.
Following are some of the basic Group Policy issues in an AD environment:
- Oftentimes, Group Policies are not applied on expected lines.
- Sometimes, they are applicable but do not work expectedly.
- Loopholes lead to slow processes.
- Odd folder redirections.
Solution: It’s essential to monitor Group Policy activities and events 24*7. This will help gather crucial information like when and how they are executed; and if there are any delays or failures. At the same time, any change that may happen to Group Policy, too, must be tracked. Simultaneously, any impact on the performance due to the changes should be detected at the beginning to resolve any issues in the Group Policies.
Challenge #2. License and maintenance cost
Microsoft uses Client Access Licenses (CALs) for the Windows Server OS, which underlies Active Directory. Since Windows Server 2016 has arrived, Microsoft moved to pre-core licensing. The price now starts at USD 6,156 for servers with two processors with eight cores each. And if you use processors with 16 crores, the cost gets doubled. But one thing that will be hard to swallow is that Open LDAP and ApacheDS are both free of charge.
Solution: It is suggested that the solution is not to replace Active Directory. Look at it from the cost center view and drive requirements for a new solution. The right step is to get a managed solution that can operate from the cloud and which will help in cancelling a number of costs. And the better is to opt for a cross-platform and independent solution; the additional costs can be mitigated.
Challenge #3. Inconvenient auditing and logging
Many things in the Active Directory need proper logging, analysis, and monitoring. To cite an example, one needs to stay abreast with critical errors and changes to the AD objects and policies. If not done on time, it can affect both the performance and security of the system. But, here lies one challenge: AD logs are technical, and finding the data requires manual searching and filtering or advanced PowerShell scripting skills.
Similarly, alerting or reporting is possible with the combination of complicated PowerShell scripts and Task Scheduler. If the PowerShell engine is outdated, its performance will be poor. For example, every time you read records filtered by time, it will read the entire event log sequentially, record by record, until it finds the record requested.
Because of this, companies are forced to integrate SIEM and Active Directory auditing solutions to ease log storage and analysis processes, spending money on things that could have been included in AD by design.
Solution: Auditing must be restricted to critical changes only. Additionally, one must make use of the Active Directory Change Tracker to scan security event logs in all domain controllers. This will help extract detailed information on each change made, including who made the change, along with the most accurate time of change.
Challenge #4. Active Directory is prone to be hacked
Due to its popularity, there are several ways and techniques to hack AD. Because it cannot be located in a DMZ, the AD server usually has an internet connection, which allows the hackers to get to the keys of the kingdom remotely. One significant weakness is that Active Directory uses the Kerberos authentication protocol with symmetrical cryptography architecture. Microsoft has patched many of the vulnerabilities to such challenges, but new problems are still in progress.
Solution: It takes too much time to analyze hacking events in order to figure out the discrepancies and get to the root of potential hacking attempts. Moreover, it’s time-consuming and painstaking as well. An AD monitoring tool that keeps an eye on the system events log for potential hacking attempts comes in handy in such cases.
Challenges #5. Offline Active Directory results in network downtime
When the Active Directory is offline, you will experience the following issues:
- Users will be disconnected from the file shares as soon as the authentication session expires, usually within a few hours.
- The software or hardware that relies on Active Directory authentication will not let people log in. Depending on the setup, it will kick current users out or keep existing sessions until they log out.
- Users will be able to log in to computers they used recently because they will have cached passwords or authentication tickets. However, someone who had not used a PC before or last used it a long time ago will not be able to log in until the connection to DC is restored. Eventually, nobody will be able to log in with a domain account because the cached authentications will expire within a few hours.
- AD servers will often play the role of DNS and DHCP servers. When AD is offline, computers will have trouble accessing the internet and even the local network itself.
Solution: To avoid the issues, the right practice is to have at least two Active Directory DCs simultaneously with failover in place. This way, when one dies, others will reinstall Windows servers on it, set it up as a new DC in an existing domain, and replicate all that within no time. But, this incurs an extra expense for AD licensing and hardware.
Challenge #6. AD is not attached to a self-service portal for end-users
Oftentimes, it is advisable to let users perform some actions themselves, such as editing their profiles and changing or resetting the passwords if forgotten. However, AD needs administrative access to these operations so that employees are forced to call the IT help desk to resolve these problems. This delays business workflows and leads to an increase in budgets as well.
Solution: Though it can be done with an additional management tool set-up, it will also entail an additional item in the budget on top of what you have already paid to get Active Directory set up.
Conclusion
AD is indeed an excellent tool for server management and is still evolving. If businesses want to integrate it into their environment, they must be ready to shell a massive chunk of their budget for the set-up and even more if they want better AD management and reporting features. To overcome the challenges, system administrators can write custom scripts and programs to work around the shortcomings of native tools and automate and improve AD management using scripting interfaces and frameworks provided by Microsoft or other parties. But it also takes ample time to write, maintain, and run the scripts. In the end, one will still have to face basic AD limitations like log file overwrites and lack of delegation.
Therefore, it is recommended that organizations turn to third-party solutions that can improve and automate AD management, auditing, and reporting. Select a solution that handles the entire infrastructure, file servers, and SharePoint and easily integrates with Unix and Linux systems. For extra services, it is an added advantage for the user. And most importantly, it should comply with the regulatory requirements of the system.
