Fetching Active Directory users and computers and GP applied to them

Telegraf
, , ,
1

Hello friends,
I am trying to implement fetching active directory users and computers, if possible, in addition to listing which group policies are active on specific users. I am using Grafana to visualize this data.
I have checked a telegraf input plugin called win_perf_counters, but I am not getting the data I am looking for with this plugin. Can someone support me with this, please?

2

Hello @Amanuel_Elhanan,
You’ll probably want to use the execd input plugin with telegraf. Telegraf can’t natively query AD, but you can write a PowerShell script that:

  • Queries AD for users and computers
  • Lists GPOs applied to users or OUs
  • Outputs the data as JSON or InfluxDB line protocol

The telegraf config might look like:

[[inputs.exec]]
  commands = ["powershell.exe -File 'C:\\Scripts\\ad_users.ps1'"]
  data_format = "influx"
  interval = "10m"

I haven’t tested it but the script might look like:

Import-Module ActiveDirectory
Import-Module GroupPolicy

# 1. Output all users with last logon in seconds since last logon
$users = Get-ADUser -Filter * -Property LastLogonDate
foreach ($user in $users) {
    $name = $user.SamAccountName
    $lastLogon = if ($user.LastLogonDate) { 
        [int]((Get-Date).ToUniversalTime() - $user.LastLogonDate.ToUniversalTime()).TotalSeconds 
    } else { 
        -1 
    }
    Write-Output "ad_user,user=$name last_logon_seconds=$lastLogon"
}

# 2. Output all computers with OS info
$computers = Get-ADComputer -Filter * -Property OperatingSystem,LastLogonDate
foreach ($computer in $computers) {
    $name = $computer.Name
    $os = $computer.OperatingSystem -replace " ", "\ "  # Escape spaces
    $lastLogon = if ($computer.LastLogonDate) { 
        [int]((Get-Date).ToUniversalTime() - $computer.LastLogonDate.ToUniversalTime()).TotalSeconds 
    } else { 
        -1 
    }
    Write-Output "ad_computer,computer=$name os=\"$os\",last_logon_seconds=$lastLogon"
}

# 3. List GPO inheritance for a set of OUs
$OUs = @(
    "OU=Sales,DC=yourdomain,DC=com",
    "OU=IT,DC=yourdomain,DC=com"
)

foreach ($ou in $OUs) {
    try {
        $inheritance = Get-GPInheritance -Target $ou
        foreach ($gpo in $inheritance.GpoLinks) {
            $gpoName = $gpo.DisplayName -replace " ", "\ "
            $enforced = $gpo.Enforced
            $enabled = -not $gpo.Disabled
            Write-Output "ad_gpo,ou=\"$ou\",gpo=\"$gpoName\" enforced=$enforced,enabled=$enabled"
        }
    } catch {
        Write-Output "ad_gpo,ou=\"$ou\" error=true"
    }
}

@skartikey might have more/better ideas.

3

Hello @Anaisdg thank you so much for your suggestion. I tried creating the script you shared and then added the config on telegraf, After restarting both telegraf and influxdb I couldn’t see any filter for a given measurement. is there anything I am missing here?

image
image826Ă—266 15.5 KB

4

Let’s troubleshoot this step by step:

  1. First, test if the PowerShell script is working correctly:
# Run this directly in PowerShell to see if it outputs data
powershell.exe -File 'C:\Scripts\ad_users.ps1'
  1. Check Telegraf logging:
  • Look at Telegraf logs to see if there are any errors. On Windows, check:
    • Event Viewer: Application Logs
    • Or run Telegraf manually: telegraf.exe --config telegraf.conf --debug
  1. Verify the Telegraf configuration:
    Here’s a corrected configuration (note it should be inputs.exec not inputs.execd):
[[inputs.exec]]
  commands = ["powershell.exe -File 'C:\\Scripts\\ad_users.ps1'"]
  data_format = "influx"
  interval = "10m"
  timeout = "30s"
  1. Common issues to check:
  • Make sure the PowerShell script path is correct and accessible
  • Ensure Telegraf has permissions to run PowerShell and access Active Directory
  • Check if Active Directory modules are installed on the server
  1. Debug the data format:
    Try adding this to your script to ensure it’s outputting valid InfluxDB line protocol:
# Add at the beginning of your script
Write-Host "Script started"
  1. Test with a simpler script first:
# Simple test script (save as test.ps1)
Write-Output "test_metric,tag=value field=1"

Then update your Telegraf config to use this test script first:

[[inputs.exec]]
  commands = ["powershell.exe -File 'C:\\Scripts\\test.ps1'"]
  data_format = "influx"
  interval = "1m"

If the test script works but the AD script doesn’t, there might be issues with the AD queries or permissions.