ADQuery 2.2.1.0001
Introduction: Active Directory Query
Systems administrators are often asked to gather information from managed systems about their Active Directory (AD) status, local user accounts, local groups, and answer questions such as:
- Who are the Primary Users of all systems?
- What AD groups is the system a member of?
- What AD groups are the system's users a member of?
- What local groups exist and what is their membership?
The Tanium platform is well-suited to gathering this sort of information, but care needs to be taken when implementing certain tooling. What seems like a simple command or query could have a greater impact than expected. For example: If there is a requirement to gather AD account information from a single system, having that single system perform a query of the AD Domain Controller (DC) would be reasonable. Since Tanium sensors are designed to run quickly, return data as rapidly as possible, and are typically run against thousands of systems at once, asking 1,000 endpoints to all provide that same information could result in an effective DDOS of those DCs. Implementing tooling which causes thousands of systems to instantaneously perform a direct query to their AD DC is not a good. The content contained in the Tanium Active Directory Query solution is intended to address the need to collect AD information from managed systems while avoiding the dangers of the direct query approach.
Tanium Active Directory Query gathers AD information by leveraging a combination of Tanium Actions and Sensors. The AD Query Actions should be configured with a distribute over time (DOT) setting which introduces a random delay into the action execution. A random value between 0 and the specified max delay is used for the actual delay time on each system. Thus, the time of when the action starts on any system will not necessarily be even. Actions won’t necessarily start exactly 5 seconds apart. The randomness of the algorithm will effectively spread the actions out in a reasonable manner. When viewed from the perspective of all targeted systems, the action is effectively run over an extended time and spread out over the distribute over time period - starting from the specified start time.
This approach to collecting AD information provides benefits such as:
- Each system's query to their DC are performed without running the risk of overloading the DC with too many simultaneous requests.
- The results of the AD query are stored locally on each system for later use by other packages or collected by sensors.
- Sensors are used to retrieve required information -an operation that is fast, low cost, and has no impact on the DCs.
Download Location
This content is available at: https://content.tanium.com/files/published/ADQuery/2018-05-22_05-45-52_2.2.1.0001-g7506326/ADQuery.xml
Usage
Target the Windows endpoints that are to query Active Directory and Deploy the package 'Collect Active Directory Info'. It is strongly recommended to use a distribute over time setting of three hours and a reissue interval of four hours when creating this Saved Action. Results of the Active Directory computer, user and group queries are saved to XML files in the tools\ADQuery folder. Any sensor starting with 'AD Query -' will query the XML files created by the 'Collect Active Directory Info' package.
Questions
AD Query - All Windows
Get Is Windows from all machines
Returns all Windows computers. Can be used for targeting of the Collect Active Directory Info package.
Packages:
AD Query - Has Stale Computer Results
Get AD Query - Has Stale Results[Computer, 4] from all machines with AD Query - Has Stale Results[Computer, 4] containing "True"
Returns computers that have AD computer data older than four hours. Can be used for targeting of the Collect Active Directory Info package.
Packages:
AD Query - Has Stale Local Administrator Results
Get AD Query - Has Stale Results[Admin, 4] from all machines with AD Query - Has Stale Results[Admin, 4] containing "True"
Returns computers that have Local Administrator data older than four hours. Can be used for targeting of the Collect Active Directory Info package.
Packages:
AD Query - Has Stale Results
Get Target from all machines with ( AD Query - Has Stale Results[Computer, 4] containing "True" or AD Query - Has Stale Results[User, 4] containing "True" or AD Query - Has Stale Results[Admin, 4] containing "True" )
Returns computers that have AD user, computer, or Local Administrator data older than four hours. Can be used for targeting of the Collect Active Directory Info package.
Packages:
AD Query - Has Stale User Results
Get AD Query - Has Stale Results[User, 4] from all machines with AD Query - Has Stale Results[User, 4] containing "True"
Returns computers that have AD user data older than four hours. Can be used for targeting of the Collect Active Directory Info package.
Packages:
Packages
Collect Active Directory Info
Queries Active Directory for three data types.
- Computer
- Pulls back all non null AD attributes
- Writes a new file each time ran
- Outputs to compAttr.xml
- Pulls back all non null AD attributes
- User
- Gets the five most recently used profiles on the local computer
- Queries AD for each user object by SID
- Pulls back all non null AD attributes
- Queries Security Event Log back 30 days for logon events to determine a primary User
- Marks a user attribute as the primary user
- Writes a new file each time ran
- Writes output to userAttr.xml
- Includes local users in user object queries
- Gets the five most recently used profiles on the local computer
- Local Group Membership
- Writes a new file each time ran
- Writes output to localGroups.xml
- Lists members of computers local groups broken out by
- Account Type (User or Group)
- Location (Domain or Local)
- Account Type (User or Group)
- Writes a new file each time ran
Should be ran with a Distribute Over Time (DOT) value in order to reduce the number of LDAP queires. Package run output is logged to a rolling logfile in the Tools\Adquery folder. Note that this package has a built in fail safe that will only allow it to be ran once every three hours. To manually override this behavior run this package with /MinMinsBetweenRuns:0.
This package contains 1 files and 0 sensors.
Additional Properties:
- Command Line: cmd /c cscript //T:300 collectAdInfo.vbs $1 $2 $3 /DCsAreAllowed:$4 /ProfileCount:$5 /LogVerbosity:$6 /PropertiesToExclude:"$7" /SIDsToExclude:"$8" /NameTranslate:$9
- Command Line Timeout: 300
Prompts:
| Name / Value | Prompt Help | Type | Possible / Default Values |
|---|---|---|---|
| Collect Computer Attributes | Checkbox | Disabled | |
| Collect User Attributes | Checkbox | Disabled | |
| Collect Local Group Memberships | Checkbox | Disabled | |
| Collect data from DCs | Checkbox | Disabled | |
| Number of user profiles | Numeric | ||
| Log Verbosity | Numeric | ||
| Properties to exclude | Text | ||
| SIDs to exclude | Text | ||
| Translate Names | Checkbox | Disabled |
Files:
- collectAdInfo.vbs
Sensors
AD Query - Logged In User Details
Returns details for the current logged on user.
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
Columns
Name Type Description Name Text Department Text Country Text City Text Text Phone Number Text
AD Query - Computer Groups
The distinguishedName of any Active Directory groups the computer is explicitly a member of (no nested groups). Also returns the computer's Primary Group. The group is returned from the memberOf attribute and is in RFC 1779 format (CN=TestGroup,OU=Sales,DC=MyDomain,DC=com).
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
AD Query - Local Groups
Returns the names of all local groups. No group members are returned.
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
AD Query - Computer Group Memberships
All Active Directory group memberships the computer is a member of -both explicitly and implicitly. Nested groups are also returned. The group is returned in NT format (SomeDomain\SomeGroup).
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
AD Query - Primary User Groups
The distinguishedName of Active Directory group memberships for the computer's primary user. The groups returned are those which the user is explicitly a member of (no nested groups). Also returns the user's Primary Group. The group is returned from the memberOf attribute and is in RFC 1779 format (CN=TestGroup,OU=Sales,DC=MyDomain,DC=com).
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
AD Query - Local Group Membership
Returns local groups and their members. To return all groups, specify All. Input accepts a single group name, or a comma delimited list of multiple names. Dependent on the AD Query content pack.
Columns
Name Type Description Group Text Member Text Location Text Type Text Parameters
Name Description Type Possible / Default Values Groups Group(s) Text Administrators
AD Query - Computer Has Group Membership
Returns True if the computer is a member of the Active Directory group.
Returns False if no match was found.
The group may be specified as groupname and domain\groupname syntax.
Multiple groups may be specified if separated by a comma. Ex: group,corp\group
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
Parameters
Name Description Type Possible / Default Values Groups Groups Text
AD Query - Primary User Group Memberships
All groups the primary user of the computer is a member of -both explicitly and implicitly. Nested groups are also returned. The group is returned in NT format (SomeDomain\SomeGroup).
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
AD Query - User Group Memberships
All group memberships the specified user is a member of -both explicitly and implicitly. Nested groups are also returned. The result is returned in NT format as UserDomain\UserName|GroupDomain\GroupName.
User names may be specified as username, domain\username.
Multiple users may be specified if separated by a comma. Ex: user,.\user,corp\user
Input 'all' into the Users field to return group membership of all inventoried users.
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
Columns
Name Type Description User Text Group Text Parameters
Name Description Type Possible / Default Values Users Users Text
AD Query - Primary User Details
Returns details for the primary user based on the number of interactive logon events.
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
Columns
Name Type Description Name Text Department Text Country Text City Text Text Phone Number Text
AD Query - Primary User
Returns the computer's primary user based on the number of interactive logon events.
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
AD Query - Logged In User Group Memberships
All group memberships the logged in user is a member of -both explicitly and implicitly. Nested groups are also returned. The group is returned in NT format (SomeDomain\SomeGroup).
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
AD Query - User Attributes
Returns specified attributes for the desired user.
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
Parameters
Name Description Type Possible / Default Values User Active Directory Username Text Attribute Active Directory Attribute Text
AD Query - Local Administrators
Returns users and groups who are a member of the local Administrators group.
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
Columns
Name Type Description Name Text Location Text Type Text
AD Query - Has Stale Results
Returns True/False value based on the time the AD Query XML files were generated and a time period the Active Directory data should be considered stale.
Parameters
Name Description Type Possible / Default Values Type AD Data Type Selection Computer
User
Groups
Hours Hours Old Numeric
AD Query - User Has Group Membership
Returns True if the user is a member of the group.
Returns False if no match was found.
Input 'any' in the User field to test any inventoried user for membership.
The user may be a local account or an Active Directory account.
The user may be specified as username and domain\username syntax.
Multiple users may be specified when separated by a comma. Ex: user,.\localuser,corp\user
The group may be a local group or an Active Directory group.
The group may be specified as groupname and domain\groupname syntax.
Multiple groups may be specified if separated by a comma. Ex: group,.\group,corp\group
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
Parameters
Name Description Type Possible / Default Values Users Users Text Groups Groups Text
AD Query - Computer Attributes
Returns the value of the specified Active Directory attribute from the computer's Active Directory object.
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.
Parameters
Name Description Type Possible / Default Values Attribute Active Directory Attribute Text
AD Query - Logged In User Groups
The distinguishedName of any Active Directory groups the user is explicitly a member of (no nested groups). Also returns the user's Primary Group. The group is returned from the memberOf attribute and is in RFC 1779 format (CN=TestGroup,OU=Sales,DC=MyDomain,DC=com).
This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.