Active Directory USer, Compter & Server Security Queries

[Anonymous]

Hi,

I'd like to use Power BI to query Active Directory & get the following information. Most of teh examples I see are all about users, however I would like server & computer info as well. Can anyone point me to the right place? My typical queries are

• Accounts, Trusted accounts with passwords that never expires or poor policy. Split this in to various groups, i.e. admins, users etc.
• Servers/Computers which haven't changed their passwords in 90 days or more. Set the value dynamically like 90 days, 1 year, 3 years etc.
• Accounts in admin type groups with bad password policies, e.g. SQL server admin with poor password policy
• Number of inactive users, computers, servers, e.g. 90+ days
• Memebers in admin groups such as DnsAdmins
• Domain Controller& servers password is weak, hasn't been changed in say 45 days etc.
• Inactive Domain Controllers & Servers. Inactive would be a variable so we could consider a server inactive if it hasn't been used in 45 or 90 or 120 days
• Number of members in each admin group. See which ones have too many members, accounts in too many groups

Now many of you will say that there are 3rd party apps that can do this. It seems a waste to use them when Power BI should be able to query & do this.

Thoughts/help?

Thanks,

Mladen

[lbendlin]

How big is your AD? The Power BI Active Directory Connector can do all that, but it becomes really slow when you have more than a couple thousand entries in the AD.

[Anonymous]

Hi,

Its only 700 users & about 1000 computers. I can access it & I have created a Power BI file that has accessed about 20 tables. I have split it & filtered it all so I have nice seperate columns. I now have to create the interrogations to get the data. I see there is a good blog on getting user info so I am going to try and learn from that. It just seemed logical to ask the Power BI experts who have worked with AD and could give e a hand. Once I am up to speed and can help back.

M

[lbendlin]

Good that it works for you. Many of us deal with ADs that are quite a bit bigger, and Power BI quickly becomes the wrong tool for handling this. Most of the processing is done before the data is ingested in Power BI.

[Anonymous]

i again,

I want to try something simple and findout the password information. The ones that interest me are:

• Paswword info
  • ms-DS-Password-Settings,
  • Bad-Password-Time,
  • Machine-Password-Change-Interval,
  • ms-DS-ManagedPassword, 
  • ms-DS-ManagedPasswordInterval,
  • ms-DS-ManagedPasswordId,
  • ms-DS-ManagedPasswordPreviousId, 
  • ms-DS-Maximum-Password-Age, 
  • ms-DS-Minimum-Password-Age, 
  • ms-DS-Minimum-Password-Length, 
  • ms-DS-Password-Complexity-Enabled, 
  • ms-DS-Password-History-Length
  • ms-DS-User-Dont-Exprie-Password
  • ms-DS-User-Password-Expired
  • ms-DS-User-Password-Not-Required
• Login info:
  • Last-Logon
  • Last-Logoff

In the online doc, it indicates that these should be in top or user, however I can't see them in the Table Records. Any idea where I can find them? Is there something I am not understanding?

Thanks

M