IMPORTANT: This site is planned to be decommissioned in 2026. Visit the Tanium Resource Center for all Tanium release notes, user guides, and support information. To view release notes in the Resource Center, see Tanium Release Notes.
IMPORTANT: If you are using semi-annual releases for on premises, see the Release notes for 2024H1 semiannual release, Release notes for 2024H2 semiannual release, or Release notes for 2025H1 semiannual release on the Tanium Resource Center.
Effective October 15, 2024: On prem release notes on the Tanium Knowledge Base are frozen. For release notes related to 7.4 or 7.5 Server and Solutions, see the Monthly updates for Tanium Version 7.4 and 7.5 Server and Solutions on the Tanium Resource Center.

ADQuery 2.2.2.0001

From Tanium Knowledge Base
Jump to navigation Jump to search


Introduction: Active Directory Query

Systems administrators are often asked to gather information from managed systems about their Active Directory (AD) status, local user accounts, local groups, and answer questions such as:

  • Who are the Primary Users of all systems?
  • What AD groups is the system a member of?
  • What AD groups are the system's users a member of?
  • What local groups exist and what is their membership?

The Tanium platform is well-suited to gathering this sort of information, but care needs to be taken when implementing certain tooling. What seems like a simple command or query could have a greater impact than expected. For example: If there is a requirement to gather AD account information from a single system, having that single system perform a query of the AD Domain Controller (DC) would be reasonable. Since Tanium sensors are designed to run quickly, return data as rapidly as possible, and are typically run against thousands of systems at once, asking 1,000 endpoints to all provide that same information could result in an effective DDOS of those DCs. Implementing tooling which causes thousands of systems to instantaneously perform a direct query to their AD DC is not a good. The content contained in the Tanium Active Directory Query solution is intended to address the need to collect AD information from managed systems while avoiding the dangers of the direct query approach.

Tanium Active Directory Query gathers AD information by leveraging a combination of Tanium Actions and Sensors. The AD Query Actions should be configured with a distribute over time (DOT) setting which introduces a random delay into the action execution. A random value between 0 and the specified max delay is used for the actual delay time on each system. Thus, the time of when the action starts on any system will not necessarily be even. Actions won’t necessarily start exactly 5 seconds apart. The randomness of the algorithm will effectively spread the actions out in a reasonable manner. When viewed from the perspective of all targeted systems, the action is effectively run over an extended time and spread out over the distribute over time period - starting from the specified start time.

This approach to collecting AD information provides benefits such as:

  • Each system's query to their DC are performed without running the risk of overloading the DC with too many simultaneous requests.
  • The results of the AD query are stored locally on each system for later use by other packages or collected by sensors.
  • Sensors are used to retrieve required information -an operation that is fast, low cost, and has no impact on the DCs.

Download Location

This content is available at: https://content.tanium.com/files/published/ADQuery/2018-07-17_06-27-14_2.2.2.0001-gb3b7321/ADQuery.xml

Usage

Target the Windows endpoints that are to query Active Directory and Deploy the package 'Collect Active Directory Info'. It is strongly recommended to use a distribute over time setting of three hours and a reissue interval of four hours when creating this Saved Action. Results of the Active Directory computer, user and group queries are saved to XML files in the tools\ADQuery folder. Any sensor starting with 'AD Query -' will query the XML files created by the 'Collect Active Directory Info' package.

Questions

AD Query - All Windows

Get Is Windows from all machines
Returns all Windows computers. Can be used for targeting of the Collect Active Directory Info package. Packages:

AD Query - Has Stale Computer Results

Get AD Query - Has Stale Results[Computer, 4] from all machines with AD Query - Has Stale Results[Computer, 4] containing "True"

Returns computers that have AD computer data older than four hours. Can be used for targeting of the Collect Active Directory Info package.

Packages:

AD Query - Has Stale Local Administrator Results

Get AD Query - Has Stale Results[Admin, 4] from all machines with AD Query - Has Stale Results[Admin, 4] containing "True"

Returns computers that have Local Administrator data older than four hours. Can be used for targeting of the Collect Active Directory Info package.

Packages:

AD Query - Has Stale Results

Get Target from all machines with ( AD Query - Has Stale Results[Computer, 4] containing "True" or AD Query - Has Stale Results[User, 4] containing "True" or AD Query - Has Stale Results[Admin, 4] containing "True" )

Returns computers that have AD user, computer, or Local Administrator data older than four hours. Can be used for targeting of the Collect Active Directory Info package.

Packages:

AD Query - Has Stale User Results

Get AD Query - Has Stale Results[User, 4] from all machines with AD Query - Has Stale Results[User, 4] containing "True"

Returns computers that have AD user data older than four hours. Can be used for targeting of the Collect Active Directory Info package.

Packages:

Packages

Collect Active Directory Info

Queries Active Directory for three data types.

  • Computer
    • Pulls back all non null AD attributes
    • Writes a new file each time ran
    • Outputs to compAttr.xml

  • User
    • Gets the five most recently used profiles on the local computer
    • Queries AD for each user object by SID
    • Pulls back all non null AD attributes
    • Queries Security Event Log back 30 days for logon events to determine a primary User
    • Marks a user attribute as the primary user
    • Writes a new file each time ran
    • Writes output to userAttr.xml

    • Includes local users in user object queries

  • Local Group Membership
    • Writes a new file each time ran
    • Writes output to localGroups.xml
    • Lists members of computers local groups broken out by
      • Account Type (User or Group)
      • Location (Domain or Local)

Should be ran with a Distribute Over Time (DOT) value in order to reduce the number of LDAP queires. Package run output is logged to a rolling logfile in the Tools\Adquery folder. Note that this package has a built in fail safe that will only allow it to be ran once every three hours. To manually override this behavior run this package with /MinMinsBetweenRuns:0. This package contains 1 files and 0 sensors.

Additional Properties:

  • Command Line: cmd /c cscript //T:300 collectAdInfo.vbs $1 $2 $3 /DCsAreAllowed:$4 /ProfileCount:$5 /LogVerbosity:$6 /PropertiesToExclude:"$7" /SIDsToExclude:"$8" /NameTranslate:$9
  • Command Line Timeout: 300

Prompts:

Name / Value Prompt Help Type Possible / Default Values
Collect Computer Attributes Checkbox Disabled
Collect User Attributes Checkbox Disabled
Collect Local Group Memberships Checkbox Disabled
Collect data from DCs Checkbox Disabled
Number of user profiles Numeric
Log Verbosity Numeric
Properties to exclude Text
SIDs to exclude Text
Translate Names Checkbox Disabled

Files:

  • collectAdInfo.vbs

Sensors

AD Query - Computer Attributes

Returns the value of the specified Active Directory attribute from the computer's Active Directory object.

This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.

Parameters

Name Description Type Possible / Default Values
Attribute Active Directory Attribute Text

AD Query - Computer Group Memberships

All Active Directory group memberships the computer is a member of -both explicitly and implicitly. Nested groups are also returned. The group is returned in NT format (SomeDomain\SomeGroup).

This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.

AD Query - Computer Groups

The distinguishedName of any Active Directory groups the computer is explicitly a member of (no nested groups). Also returns the computer's Primary Group. The group is returned from the memberOf attribute and is in RFC 1779 format (CN=TestGroup,OU=Sales,DC=MyDomain,DC=com).

This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.

AD Query - Computer Has Group Membership

Returns True if the computer is a member of the Active Directory group.
Returns False if no match was found.

The group may be specified as groupname and domain\groupname syntax.
Multiple groups may be specified if separated by a comma. Ex: group,corp\group

This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.

Parameters

Name Description Type Possible / Default Values
Groups Groups Text

AD Query - Has Stale Results

Returns True/False value based on the time the AD Query XML files were generated and a time period the Active Directory data should be considered stale.

Parameters

Name Description Type Possible / Default Values
Type AD Data Type Selection

Computer
User
Groups

Hours Hours Old Numeric

AD Query - Local Administrators

Returns users and groups who are a member of the local Administrators group.

This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.

Columns

Name Type Description
Name Text
Location Text
Type Text

AD Query - Local Group Membership

Returns local groups and their members. To return all groups, specify All. Input accepts a single group name, or a comma delimited list of multiple names. Dependent on the AD Query content pack.

Columns

Name Type Description
Group Text
Member Text
Location Text
Type Text

Parameters

Name Description Type Possible / Default Values
Groups Group(s) Text Administrators

AD Query - Local Groups

Returns the names of all local groups. No group members are returned.

This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.

AD Query - Logged In User Details

Returns details for the current logged on user.

This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.

Columns

Name Type Description
Name Text
Department Text
Country Text
City Text
Email Text
Phone Number Text

AD Query - Logged In User Group Memberships

All group memberships the logged in user is a member of -both explicitly and implicitly. Nested groups are also returned. The group is returned in NT format (SomeDomain\SomeGroup).

This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.

AD Query - Logged In User Groups

The distinguishedName of any Active Directory groups the user is explicitly a member of (no nested groups). Also returns the user's Primary Group. The group is returned from the memberOf attribute and is in RFC 1779 format (CN=TestGroup,OU=Sales,DC=MyDomain,DC=com).

This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.

AD Query - Primary User

Returns the computer's primary user based on the number of interactive logon events.

This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.

AD Query - Primary User Details

Returns details for the primary user based on the number of interactive logon events.

This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.

Columns

Name Type Description
Name Text
Department Text
Country Text
City Text
Email Text
Phone Number Text

AD Query - Primary User Group Memberships

All groups the primary user of the computer is a member of -both explicitly and implicitly. Nested groups are also returned. The group is returned in NT format (SomeDomain\SomeGroup).

This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.

AD Query - Primary User Groups

The distinguishedName of Active Directory group memberships for the computer's primary user. The groups returned are those which the user is explicitly a member of (no nested groups). Also returns the user's Primary Group. The group is returned from the memberOf attribute and is in RFC 1779 format (CN=TestGroup,OU=Sales,DC=MyDomain,DC=com).

This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.

AD Query - User Attributes

Returns specified attributes for the desired user.

This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.

Parameters

Name Description Type Possible / Default Values
User Active Directory Username Text
Attribute Active Directory Attribute Text

AD Query - User Group Memberships

All group memberships the specified user is a member of -both explicitly and implicitly. Nested groups are also returned. The result is returned in NT format as UserDomain\UserName|GroupDomain\GroupName.

User names may be specified as username, domain\username.
Multiple users may be specified if separated by a comma. Ex: user,.\user,corp\user
Input 'all' into the Users field to return group membership of all inventoried users.

This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.

Columns

Name Type Description
User Text
Group Text

Parameters

Name Description Type Possible / Default Values
Users Users Text

AD Query - User Has Group Membership

Returns True if the user is a member of the group.
Returns False if no match was found.

Input 'any' in the User field to test any inventoried user for membership.
The user may be a local account or an Active Directory account.
The user may be specified as username and domain\username syntax.
Multiple users may be specified when separated by a comma. Ex: user,.\localuser,corp\user

The group may be a local group or an Active Directory group.
The group may be specified as groupname and domain\groupname syntax.
Multiple groups may be specified if separated by a comma. Ex: group,.\group,corp\group

This sensor is dependent on the AD Query content pack and will only return data after the Collect Active Directory Info package has completed an inventory.

Parameters

Name Description Type Possible / Default Values
Users Users Text
Groups Groups Text
Retrieved from "https://kb.tanium.com/wiki/index.php?title=ADQuery_2.2.2.0001&oldid=28054"