Connect Microsoft Active Directory

This guide provides the required steps to connect Microsoft Active Directory to Cloud Control Center as a data enrichment source for users and devices. For details on what data and events Elisity collects and how that data is used, please see our Active Directory Integration Event Polling Details article. 

This guide is for installing the Elisity Active Directory agent on any member server or domain controller using AD Agent 5.0.0+ with the latest available release of Cloud Control Center.

Before You Begin

The deployment is completed in three parts. Part 1 prepares Active Directory so that the directory emits the audit events the agent collects. Part 2 obtains the agent package and its onboarding credentials from Cloud Control Center and installs the agent on a Domain Controller or member server. Part 3 supplies the service account and the Domain Controllers to monitor, which is what takes the agent from a degraded state to Active. Work through the parts in order; the agent cannot complete its configuration until every part is done.

Configuration Steps are as follows:

1. Create a Service Account
2. Update GPO Settings
3. Modify User Audit Settings (ADSI Edit)
4. Install the Agent
5. Set the Service Account Credentials in Cloud Control Center
6. Configure the Domain Controllers in Cloud Control Center

Have the following ready before you start:

• Rights in Active Directory to create a user account, edit Group Policy, and change auditing in ADSI Edit on the monitored domain
• Administrator access to the Windows host that will run the agent — a Domain Controller or a member server of the root domain
• Access to Cloud Control Center with permission to manage connectors
• Outbound TCP 443 open from the agent host to Cloud Control Center

Part 1: Prepare Active Directory

Part 1 is performed entirely in Active Directory and on the Windows host. It creates the account the agent runs as, enables the audit policies that generate the events Elisity collects, and adds the directory auditing entry that reports attribute changes. None of this work requires Cloud Control Center.

Installation Prerequisites

Outbound Port 443 is required to send Event Logs to Elisity CCC from the Elisity Agent.

Minimum requirements for the agent host machine:

• Microsoft .Net Framework v4.7.2 or newer - Please use the link here for guidance on determining the framework version
• 4GB RAM
• 1 GB free disk space

The Elisity AD Connector should be installed on a Windows machine that is a member of the root domain of the enterprise.

Supported Windows versions for hosting the AD Agent include:

• Windows 10 Enterprise LTSC 2019 (version 1809) — supported by Microsoft through January 9, 2029
• Windows 11 Enterprise LTSC 2024 — supported by Microsoft through October 9, 2029
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022

It can also be installed directly on a Domain Controller running:

• Windows Server 2016
• Windows Server 2019
• Windows Server 2022

Host Operating System Considerations
Windows 10 Enterprise LTSC 2019 and Windows Server 2016 can be used to host the AD Agent; however, these operating systems do not include native support for TLS 1.3, which provides enhanced encryption and performance benefits. Note that general-availability (non-LTSC) editions of Windows 10 have already reached end of support from Microsoft and should not be used for new deployments. Customers with compliance or security requirements that specify newer TLS versions may prefer to deploy the AD Agent on Windows 11 Enterprise LTSC 2024 or Windows Server 2019 or later.

Antivirus and Endpoint Protection Software Configuration

If your environment uses antivirus or endpoint protection software, configure exclusions for the Elisity AD Agent folders and processes before installation. Starting with AD Agent 5.0.0, the agent uses an automatic update mechanism that downloads and launches updated agent versions from a cache directory. Antivirus software may block these processes or quarantine files, preventing the agent from starting or updating properly.

Folders to Exclude from Antivirus Scanning

Configure your antivirus software to exclude the following folders from real-time scanning, monitoring, and quarantine:

• C:\Program Files\Elisity\ADAgent - Main agent installation directory containing the initially installed agent executable and components
• C:\ProgramData\Elisity\ADAgent - Agent data directory containing cache, logs, and configuration files
• C:\ProgramData\Elisity\ADAgent\Cache\Versions - Downloaded agent versions directory where updated agent executables are stored and launched from

Windows Services

The AD Agent installs two Windows services: The Elisity AD Agent Bootstrapper and the Elisity AD Agent. Both services must be allowed to operate without interference:

• Elisity AD Agent Bootstrapper - Locates the latest version of the agent executable and launches it with updater arguments. This service always runs from the Program Files installation directory and validates the digital signature of agent executables before launching. Runs as Local System to ensure access for configuring other windows services.
• Elisity AD Agent Service - Main agent service that handles Active Directory integration and communication with Cloud Control Center. Initially runs from Program Files, but after updates runs from the Cache\Versions directory. Runs as a service user with supplied credentials during install with specific permissions for Active Directory and Event Log Reading. 

Process Behavior and Antivirus Considerations

The AD Agent update mechanism works as follows:

1. The Bootstrapper service launches Agent.exe with the -updater argument
2. The updater process downloads new agent versions to C:\ProgramData\Elisity\ADAgent\Cache\Versions\{Revision}\Agent.exe
3. The AD Agent Bootstrapper installs the Elisity AD Agent service and updates the service executable path to the cached version
4. After the first update, both the updater and Agent service run from the Cache\Versions directory instead of Program Files

This architecture supports automatic rollbacks and fail-safes, but the dynamic executable paths may trigger antivirus heuristic detection or behavior monitoring. Ensure your antivirus software:

• Allows processes to be launched from the ProgramData\Elisity folder structure
• Does not block or quarantine executables downloaded to the Cache\Versions directory
• Permits Windows services to modify their own executable paths
• Allows the Bootstrapper to validate and launch signed executables

Create a Service Account for the Elisity AD Connector

1. Create a new user in the appropriate domain which will be monitored for events by Elisity to act as the Elisity AD Service Account.
2. Give the user a unique name to identify it as the Elisity AD Service Account.
3. Protect the user from accidental deletion.
4. Add the user to the domain Event Log Readers group. In Active Directory Users and Computers, open the Builtin container of the monitored domain, open the Event Log Readers group, and add the Elisity AD Service Account as a member.

Update Group Policy Settings

Enable the audit policies the AD Agent depends on. Apply the settings below to a Group Policy Object that targets every Domain Controller in the monitored domain.

1. Go to: Server manager > Tools > Group Policy Management

   • Create a new GPO (applicable to all DCs) or edit the default Domain Controller GPO as follows (figure 1)

    
   Figure 1 (click image to enlarge)

2. Go To: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Account Logon

   • Enable Success (figure 2) for 'Kerberos Authentication Service'
   • Enable Success (figure 2) for Audit Kerberos Service Ticket Operations

    
   Figure 2 (click image to enlarge)

3. Go To: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Account Management

   Enable Success for Audit Computer Account Management, Audit Security Group Management, and Audit User Account Management (figure 3)

    
   Figure 3 (click image to enlarge)

4. Go To: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > DS Access

   • Enable Success for Audit Directory Service Changes (figure 4)

    
   Figure 4 (click image to enlarge)

5. Go To: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Logon/Logoff

   • Enable Success for Audit Account Lockout, Audit Group Membership, and Audit Logon

    
   Figure 5 (click image to enlarge)

Modifying User Auditing Settings in ADSI Edit

Add an auditing entry on the Users container so that Active Directory generates audit events for user and group attribute changes.

1. Go To: Server Manager > Tools > ADSI Edit

   • In ADSI Edit, click Action > Connect to… > Default Naming Context.
   • Click Ok.

2. Right click Users and select Properties (figure 6)

   
   Figure 6 (click image to enlarge)

3. Select Security tab > click Advanced > select Auditing tab (figure 7)

    
   Figure 7 (click image to enlarge)

4. Click Add (figure 8) > click select principal (figure 9)

    
   Figure 8 (click image to enlarge)

    
   Figure 9 (click image to enlarge)

5. In the Permissions list, first check the Full control box. Checking Full control is a shortcut that selects every permission in the list at once.

6. Then deselect (uncheck) the following four permissions, leaving every other permission checked:

   • Full control
   • List contents
   • Read all properties
   • Read permissions

   Because Full control is used only to select everything, and is then unchecked along with the three read permissions, Figure 10 below shows the finished result — those four boxes appear unchecked and all remaining permissions appear checked. Compare your screen against Figure 10 before clicking OK.

    
   Figure 10 — the finished permission selection, after deselecting the four permissions above (click image to enlarge)

7. Click OK and exit

8. After completing everything above, go to the command prompt and execute the command:

   gpupdate/force

   This will update all the policy changes without needing any reboots.

Part 2: Install the AD Agent

Part 2 has two halves. First, download the agent package and read the onboarding credentials in Cloud Control Center. Then run the installer on the Windows host and supply those credentials to the installer.

Download the Agent from Cloud Control Center

Download the agent from Cloud Control Center. This section covers the Cloud Control Center side of the installation: add the Active Directory connector, download the agent package, and copy the credentials the installer asks for. Running the installer on the Windows host is covered in Run the Installer on the Domain Controller below.

Adding an Active Directory agent begins in the connector catalog. Navigate to IdentityGraph > Connectors, then click Add Connector to open the Add Connector drawer alongside the Connectors list. Type Active Directory into the drawer search box to narrow the catalog to the Active Directory connector card. The card is marked with an Active chip and describes the connector as follows: "Active Directory (AD) is a directory service for Windows domain networks that authenticates and authorizes all users and computers." Click Configure on the card to begin onboarding.

Clicking Configure opens the Add Active Directory page, which presents the three steps required to complete onboarding: Step 1: Configuration Information, Step 2: Download Elisity AD Agent, and Step 3: Installation Instruction.

To download the agent and read its onboarding credentials:

1. Under Step 2: Download Elisity AD Agent, click Download Elisity AD Agent. If attempting to install an Active Directory Agent different than the version available for download in Cloud Control Center, contact your Elisity Engineer who can work with you to provide a specific version of the agent.

   

2. Save the agent zip file to your local laptop/desktop for later transfer, or directly on the machine where the Connector will be installed.
3. Under Step 1: Configuration Information, click View Configuration Information.
4. Copy and save both the Gateway Server URL and Gateway Credential
   • Note: You can click the Copy icon to save the Credential to Clipboard
   • These credentials are valid for 60 minutes after being generated.

   

Here is where you can also view and copy the configuration information to onboard the agent.

Run the Installer on the Domain Controller

Run the installer on the Windows host. This section covers the Windows side of the installation, using the Gateway Server URL and Gateway Credential copied in the previous section.

Follow the steps below to install the AD Agent on the local Domain Controller or Member Server.

1. Launch the Installer

Open the Elisity AD Agent Installer as an Administrator. Click Next to begin configurations for the install.

2. Choose Destination Folder

•  
  • In the second window of the installer, you can change the destination folder. However, the main configuration file and the folder containing logs will remain in C:\ProgramData\Elisity\ADAgent and cannot be changed.

3. Provide Cloud Control Center Configuration Details

Enter the required CCC configuration details that can be gathered from the AD Agent Configuration Page in Cloud Control Center. These are the credentials which were copied from Cloud Control Center in a previous step.

After entering the Gateway and Secret configurations, click Test access to verify access to Cloud Control Center. If outbound 443 is permitted and you have entered the correct credentials, you will see a Cloud Access Succeeded message. Errors with credentials or connectivity will result in a Cloud Access Failed message with appropriate error messages to assist in troubleshooting.

4. Final Installation

Complete the installation of the service by clicking Install.

Elisity AD Agent Bootstrapper Service

Once installation is complete, the Elisity AD Agent bootstrapper process will start and should maintain a running status until additional configurations are made in Cloud Control Center. The bootstrapper checks Cloud Control Center for configurations every 30 seconds until all configurations are submitted - at which point the Elisity AD Agent service will start and run in parallel with the bootstrapper service. 

Part 3: Complete Configuration in Cloud Control Center

This is Part 3, the final part of the deployment. The two configurations below are performed in Cloud Control Center and must be completed in the order given: service account credentials first, then the Domain Controllers. Until both are done the agent reports what is still missing and remains in a degraded state.

Now that the AD Agent has been installed and the bootstrapper process has started, service credentials and Sync/Event Domain Controllers must be configured in Cloud Control Center to complete the installation process.

Until these configurations are made, the AD Agent will remain in a degraded state with error messages viewable by hovering over the information icon next to the degraded status.
This is the expected state at this stage - the next two steps will provide configurations to remove the degraded status and finalize the configuration, resulting in an Active status.

Clicking the agent's Status opens the AD Agent Status view, where the Updater reports what is still outstanding. On a fresh installation the Updater records a warning for each sub-agent it cannot install until a service account is supplied — Elisity AD Agent - No Service Credentials configured, can not install the a... and Elisity Syslog Agent - No Service Credentials configured, can not install t....

Two configurations complete the deployment, and they must be performed in this order:

1. Set the service account credentials the agent uses to read the directory and the Security event logs.
2. Configure the Domain Controller used for synchronization and the Domain Controllers monitored for events.

Supplying the credentials clears the first condition and allows the Updater to install the sub-agents. The agent then reports that its Domain Controllers still need to be configured. Completing the second step finishes the deployment: the agent settles into an Active state and its row lists the Domain Controllers it is polling. For a full description of the AD Agent Status view and the logs behind each service, see Monitoring AD Agent Health later in this article.

Navigate to IdentityGraph > Connectors and select the Active Directory connector. The Active Directory Agents page opens under the breadcrumb Connectors > Active Directory and lists every agent onboarded to the tenant.

The Agents table reports the following for each agent:

A Search field sits above the table. The controls to the right of it filter the table, choose which columns are displayed, refresh the data, and export the table as a spreadsheet. These controls are covered in Filtering and Exporting AD Agents and Monitored DCs later in this article.

Configuring the Elisity Service Account

To address the first degraded status message, we will set the service account credentials to be used by the agent. This account will also be used to communicate with configured Domain Controllers in the next step.

To set the credentials:

1. Click Actions (⋮) to the right of the agent row and select Set Credentials.

2. Enter the credentials for the service account created earlier. Note that for credentials to be accepted, the username must contain the SLD (second-level domain) with a blackslash, followed by the account name. In this example, the username is formatted as sld\username or mydomain\elisitysvc.

   

3. Select Use gMSA Account if the Elisity Agent will run using a Group Managed Service Account; leave it unchecked when using a standard Active Directory user account.

4. Click Save to apply the credentials.

The Set Credentials window displays the Agent Name and the following fields:

Configuring Event Collection Domain Controllers

After successfully configuring the service account credentials, the degraded status message will change to No configuration found, please configure the Domain Controllers.

To address this message, configure both the Domain Controller used for initial Sync processes and the Domain Controllers which will be monitored for events.

1. Go to IdentityGraph > Connectors and select the Active Directory connector to open the Active Directory Agents page. Click the Actions menu (⋮) on the newly onboarded agent, then select Configure Agent. The Configure Agent page opens as a full-page view with the Agent Name, Description, and the Domain Controllers configuration section below.

2. Enter a Description for the agent. The field is optional and accepts up to 255 characters; the value appears in the Description column of the Agents table.
3. Enter the Domain Controller for Sync (LDAPS/LDAP). This is the single Domain Controller the agent queries for the directory synchronization, and the field accepts only one entry.
4. Select an Interface Mode — Visual Mode or Text Mode — and enter the Domain Controllers to be polled for events. Both modes are described below, and switching between them preserves entered values.

5. After entering the Sync Domain Controller and at least one Event Polling Domain Controller, click Save Changes.

Cancel discards the edits and returns to the Agents page.

The page carries the breadcrumb Agents > Configure Agent. Agent Name is read-only and reports the hostname the agent registered with. Description is an optional free-text label of up to 255 characters that appears in the Description column of the Agents table.

The Configure Agent page contains two tabs: Domain Controllers and Domain Controllers Filters. The Domain Controllers tab provides a field for the Domain Controller for Sync (LDAPS/LDAP) used for initial synchronization, and an Interface Mode selector with two radio buttons — Visual Mode and Text Mode — for entering the Event Polling Domain Controllers. Switching between modes preserves entered values.

Visual Mode

Visual Mode is the default entry method and displays a Domain Controllers table listing each configured Event Polling Domain Controller by DC Name / Hostname. Each row includes edit and delete action icons. Click + Add Domain Controller to add a new entry.

A search field and filter and column controls sit above the table for longer lists. Use Visual Mode for incremental edits to an existing configuration.

Text Mode

Text Mode provides a Configuration text area for entering Domain Controllers in bulk. Enter one Domain Controller per line. Text Mode is useful when copying a list of Domain Controllers from an existing source or when configuring a large number of Domain Controllers at once. Switching back to Visual Mode preserves the entries.

Domain Controller Filters

The Domain Controllers Filters tab suppresses logon events generated by well-known system and anonymous accounts, so that machine and service activity does not enter IdentityGraph as user logons. Filtering these accounts out keeps user-to-device associations meaningful and prevents identity-based policy from following an account that does not represent a person.

Each filter is listed with the following:

Two filters are provided and enabled by default:

Adding a Filter

1. Click + Add Filter to append an editable row to the bottom of the grid. Enter a Name, choose a Status and a Block Type, and enter the regular expression in Value. For example, a filter named Service Accounts with a Block Type of By Username and a Value of ^svc-.*$ suppresses logon events for every account whose name begins with svc-.

   

2. Use the save icon in the row's Actions column to stage the new filter, then click Save Changes at the bottom of the page to commit it. The discard icon next to it cancels the row.

Verify the Deployment

Post-Configuration Checks

After a few moments, the status of the AD Agent should show Active and you will see the monitored Domain Controllers in the Details view for the AD Agent. You will also see the domain in which the host machine resides, and consequently the domain which is being monitored by the Agent.

1. Confirm that the agent Status reads Active on the Active Directory Agents page.

2. Each agent row expands to list the Domain Controllers that agent polls for events. Click the chevron to the left of the Agent Name to expand the row.

   

3. Confirm that each Domain Controller listed in the sub-table reports a Status of Active.

The Domain Controller sub-table reports the following:

When one or more of an agent's Domain Controllers is inactive, a warning banner appears directly above the sub-table and reports how many are affected, for example 1/3 Domain Controllers are inactive. The banner is visible as soon as the row is expanded, so a partially degraded agent can be identified without opening each Domain Controller in turn.

Domain Controller Status Indicators:
Active: AD Agent is actively polling events.
Inactive: AD Agent is not actively polling events (e.g., when the service is stopped) or the Domain Controller is unreachable.

• The Agents table includes Active DCs and Inactive DCs columns that display the count of monitored Domain Controllers in each state. A green indicator accompanies the Active DCs count and a red indicator accompanies the Inactive DCs count, providing an at-a-glance view of Domain Controller health.
• Use the column chooser in the toolbar to show the Active DCs and Inactive DCs columns if they are not displayed.
• For any DCs with Inactive status, expand the agent row and hover over the status info icon for details on any errors that occurred. If errors have occurred after deployment, you can check the Status Changed On attribute (for insight on when the error occurred) to cross-reference with any logs on the DC.
• The general guidance is 50 monitored domain controllers per AD agent, but depending on the environment the supported domain controllers per AD agent could be higher or lower depending on various factors.

Trigger an Initial Sync

Next, trigger a sync from Cloud Control Center when you are ready to start importing users and devices. Upon completing the initial sync, devices existing in Cloud Control Center are enriched with any existing data in Active Directory.

1. Open the Actions menu (⋮) on the agent and select Sync. Sync Status changes from Not started and Last Sync is populated when the run completes.

2. Confirm that the Domain column reports the domain the agent monitors once the sync completes.

All status and configuration changes for both Agents and Monitored Domain Controllers can be viewed in the Cloud Control Center Monitoring dashboard. Go to Monitoring > Events and optionally filter by Category: Active Directory. Specifics for all events can be viewed in the Details column in the Events view.

Monitoring and Managing the AD Agent

The remainder of this article is reference material for running the connector once it is deployed: the operations available on each agent, where agent and Domain Controller health is reported, where the identities and logons the agent imports are found, and how the agent inventory is filtered and exported.

Agent Row Actions

With the agent deployed and reporting Active, the Actions menu (⋮) at the right of each agent row provides seven operations for the ongoing management of that agent.

Monitoring AD Agent Health

The AD Agent is not a single process. Its health is reported as three independent services, each with its own status chip and its own timestamped log. Click the information icon next to an agent's Status on the Active Directory Agents page to open the AD Agent Status window.

Expand any of the three to reveal its log. Each log lists Time, Status, and Description, with severity reported as Info or Warning. A View In Agent Events link at the bottom of each log opens the full events page for that agent, where longer messages are shown untruncated.

Updater

A healthy Updater log records Updater Starting followed by Updater is Running. On a fresh installation it also records two warnings:

• Elisity AD Agent - No Service Credentials configured, can not install the a...
• Elisity Syslog Agent - No Service Credentials configured, can not install t...

These two warnings are expected before the service account is supplied and are not a fault. Once Set Credentials is completed, the Updater logs Elisity AD Agent - New service credentials available, trying to update/inst... and installs the sub-agents. If the warnings persist after credentials have been saved, confirm that the account is valid and that it can log on as a service on the agent host.

Agent

A healthy Agent log records Agent Starting followed by Agent is Running, and then Configuration applied, starting internal services. Version = 1 once the configuration saved on the Configure Agent page has been received and applied. The version number increments each time a new configuration is applied, which confirms that a change made in Cloud Control Center reached the host.

The log also records the negotiated transport as a warning, for example SSL Protocol used for CCC connection: Tls12. This entry is informational rather than a fault; it identifies which TLS version the host operating system negotiated. Hosts that do not support TLS 1.3 report TLS 1.2 here, as described in Installation Prerequisites.

AD Agent

A healthy AD Agent log records AD Agent Starting followed by AD Agent is Running. The AD Agent service is installed by the Updater, so its log remains empty until service account credentials have been supplied.

Checking Domain Controller Status

The AD Agent Status window reports the health of the agent as a whole. To diagnose a single failing Domain Controller, expand the agent row and click the information icon on that Domain Controller's Inactive status chip. The Domain Controller Status window reports the Agent Name, the DC Host Name, the DC Status, and an event log scoped to that one Domain Controller.

The entries below are typical of this log and identify where a Domain Controller stopped being polled:

A View In Agent Events link at the bottom of the log opens the full event history for the agent.

Reviewing Agent Events

The AD Agent Status and Domain Controller Status windows each report on one agent or one Domain Controller. Monitoring > Agent Events aggregates the events from every agent in the tenant into a single page, which is the practical starting point when more than one agent is deployed.

A time-range selector at the top right of the page scopes the table, and the controls beside it filter the table, choose which columns are displayed, refresh the data, and export the results.

The View Events item in an agent's Actions menu and the View In Agent Events links in the status windows both open this page pre-filtered to the agent you started from.

Locating and Managing Users After AD Connection

Once you have successfully connected Active Directory (AD) to your Cloud Control Center, navigating to and managing users is straightforward. 

Navigate to IdentityGraph > Users and select the Active Directory tab. A User summary panel above the table reports the number of Active Directory users, the number of Microsoft Entra ID users, and a breakdown of users by status.

The page segments identities by the source they were learned from, so the accounts imported by the AD Agent are listed on their own tab rather than in one combined list. Select the tab that matches the source you are working with:

With the Active Directory tab selected, the table below the summary panel reports every user imported from the directory, including the Name, the Account ID, and a Status of either Active or Inactive.

Overview of the Users Page

The Users page is designed to provide a comprehensive overview of all users within the organization, directly pulled from Active Directory. Here's what you can expect.

User Information

The page lists essential details for each user, including Name, Account ID, Status (Active or Inactive), Groups, Department, Assets, Title, Last Activity, Created On, and more.

User Assets

You can see all assets associated with an Active Directory User by clicking the number of assets in the respective column. This is critical for quickly identifying which devices users are logged in to.

Assets are dynamically updated with user associations as they log in and out of domain-joined machines throughout the network. This ensures that policy can be configured to follow user identity regardless of where a user signs in, if this is the desired behavior.

Select the value in the Assets column on a user row to open the Assets window. The window title carries the number of associated machines in parentheses, the Name field reports the user the list belongs to, and the table below it lists one row for each machine that user has been seen on. In the example below, the Assets window for the user Chad Reed lists a single machine, WIN-PRO$, at 10.100.102.210.

Each row in the Assets window reports the following:

The Assets window is the path from an Active Directory identity to the machines that identity has actually been seen on. Select the icon in the Details column to open the Device Details page for that machine, or select Close to return to the Users table. Search, filter, column, refresh, and export controls are provided above the list for users with a large number of associated machines. Device Details is where the logon history for a machine is reported, which is the subject of the next section, Viewing Active Directory User Logons in Device Details.

Status Indicators

Each user's current status is clearly indicated, allowing administrators to quickly ascertain which users are active or inactive within the system.

Search and Filter

A search bar is provided at the top of the page, enabling administrators to quickly locate specific users based on their name or account ID. This is particularly useful in larger organizations with many users.

Viewing Active Directory User Logons in Device Details

Opening a machine from a user's Assets window lands on the Device Details page for that machine, which is where the logon history for the machine is reported. The example below continues from the previous section: the device shown is the machine associated with the Active Directory user opened there.

AD User Logons

The AD User Logons tab displays a historical list of Active Directory users who have logged into the selected device. This view helps track which users have accessed a machine over time.

Navigate to IdentityGraph > Devices, select a device to open Device Details, then select the AD User Logons tab.

Table Columns

• User – Username of the logged-in AD user

• IP Address – IP address used during the login

• Login Time – Timestamp of the logon event

Table Features

• Time range selector: Last 1 hour, 24 hours, 7 days, 30 days

• Sortable and searchable columns

• Save, export, and import filters

• CSV export with full “Select All” support

The Device Details page carries the breadcrumb Devices > Device Details and is headed by the hostname of the device, with Edit and Delete controls to the right of it. Three summary cards describe the device before any logon history is read:

Below the cards, select the AD User Logons tab. The same tab row also provides Identity Graph, Analytics, Device Events, Policy Evaluator, and Zero Trust Posture.

The device above, WIN-PRO$, is the machine opened from the Assets window in the previous section, and the single logon row reports chad, the account ID of the same user that machine was listed under. The IP Address in the logon row matches the address reported for the machine in both the Assets window and the Device Information card, which is how a logon is tied to one device. The three columns above carry the following labels in Cloud Control Center:

The selector at the top right of the tab scopes the table to a time range and reads Last 30 Days above. A tab that appears empty most often has a time range that predates the logon, so widen the range before concluding that no logon data exists for the device. A Search field sits at the left of the tab, and the controls beside the time-range selector filter the table, choose which columns are displayed, refresh the data, and export the results.

Logon events are retained for 30 days. The tab is shown for all devices but will be empty unless AD logon data is available.

Configuring AD User Preemption

The AD User Logons tab records every Active Directory logon seen on a device. Which of those logons IdentityGraph treats as the current user of that device is governed by a single global setting on the Active Directory connector.

AD User Preemption is a setting that determines how the Active Directory Connector handles user logins detected on domain-joined computers. This setting affects how quickly user-to-device associations are updated in IdentityGraph, which in turn impacts policy enforcement based on user identity.

When AD User Preemption is enabled (the default behavior), Cloud Control Center will immediately associate a new Active Directory user login with a device, replacing the previous user identity if one exists. This ensures the most up-to-date user is always reflected in IdentityGraph, enabling identity-based policy to follow the actual user more accurately and in near real time.

When disabled, user identity for a device will only be updated after four (4) hours of inactivity by the previously associated user. This provides a grace period where short-duration or transient logins will not trigger a change in device ownership unless they persist.

Note: This feature is controlled globally and applies to all Active Directory Connectors within your environment. There is no per-agent configuration.

Enabling or Disabling AD User Preemption

Navigate to IdentityGraph > Connectors in Cloud Control Center, locate the Active Directory connector, and select Global Settings from the row's Actions (⋮) menu. On the Edit Active Directory page, toggle Enable User Preemption on or off under Active Directory User Preemption, then select Close.

Filtering and Exporting AD Agents and Monitored DCs

Reach the Active Directory Agents page from IdentityGraph > Connectors by selecting the Active Directory connector.

Search, Filter, and Column Controls

A Search field sits above the table and matches against the visible rows. Four controls are provided to the right of it: a filter control for building column-level conditions, a column chooser for showing and hiding columns, a refresh control for reloading the table, and an export control. Note which columns are hidden before exporting, because the two export options treat hidden columns differently. The export control is highlighted in the capture below.

In the capture above, agent WIN-NLLE95RT4M1 in the taylor.local domain reports a Sync Status of Completed and a Last Sync of 08/12/2026 04:50 PM. The agent row is expanded to show its Domain Controllers sub-table, headed by the 1/3 Domain Controllers are inactive banner. Both the agent row and the expanded Domain Controller rows are carried into the export.

Export Options

The Active Directory Agents page can be filtered, customized, and even exported as a CSV - consistent with all other tables in Cloud Control Center. Exports can be performed in one of two ways:

Export All Data: This option ignores any applied filters and exports all available columns, even those hidden in the current view. However, the column order in the Cloud Control Center is retained, ensuring that the exported data aligns with your customized layout.
Export Filtered Data: Use this option to export only the DCs currently visible on the page. Any filters applied to the device page are preserved in the exported data, and hidden columns are excluded. Like the "Export All Data" option, the column order from Cloud Control Center is retained in the exported file.

Click the Export data icon in the AD Agent list view to generate a downloadable spreadsheet containing structured data about each agent and controller in the deployment.

Exported Fields

Exported data includes the following fields:

In addition, each associated Domain Controller (DC) is listed with the following details:

Exported reports are helpful for:

• Troubleshooting AD connectivity issues

• Verifying deployment coverage

• Reviewing AD Agent software versions and status trends

Upgrade or Uninstall Process

To Upgrade or Uninstall, run the latest version of the AD Agent installer. The installer will check the version of the currently installed Elisity agent and present the appropriate options to upgrade, repair/change configurations, or uninstall. If the currently installed version is the same as the installer version, running the insgtaller will present the Change, repair, remove installation window.

If the installer version is newer than the currently installed version, the change/repair/remove wizard is skipped and the upgrade wizard is started immediately.

Upgrading the AD Agent

If using AD Agent 5.0.0+, upgrades happen automatically using the AD Agent boostrapper process. If upgrading from a previous version, follow these steps:

If a configuration file exists in C:\ProgramData\Elisity\ADAgent\Config, the installer will detect it during an upgrade or reinstallation. There are two options to proceed:

Option 1: Keep Existing Configuration

1. Select Keep existing configuration.
    
    
2. Proceed with the installation.

Option 2: Overwrite Existing Configuration

1. Deselect Keep existing configuration.

2. Provide cloud credentials.

3. Finish the installation by clicking Install.

Active Directory Attributes Available as Match Criteria

Attributes sourced from Microsoft Active Directory can be used as Policy Group match criteria in a proactive manner through our Active Directory integration. Elisity queries the directory directly through the Active Directory Connector Service (ADCS), allowing you to define Policy Groups using directory data - even if no assets matching those attributes have yet been discovered or enriched in IdentityGraph.

Supported attributes include both device and user metadata, such as:

• Device Attributes: Device Name, Operating System, Device Distinguished Name (DN), Group Membership

• User Attributes: Account Name, Department, Title, Company, Employee Type, Group Membership, and more

This enables proactive segmentation strategies using identity-based criteria that are broadly defined across the organization. For more details, see the Active Directory Attributes in IdentityGraph or the Policy Groups article.