Troubleshoot AD Agent Issues

This article covers the most common issues that occur after the Elisity AD Agent is installed and running. For installation instructions, see Connect Microsoft Active Directory.

Step 1: Identify the Issue in Cloud Control Center

Before changing anything on the host, use Cloud Control Center to determine which component is failing and why.

• Go to Settings > Active Directory > Agents. Check the Agent Status (Active, Degraded, or Inactive) and the Active DCs / Inactive DCs counts. A green indicator accompanies Active DCs; a red indicator accompanies Inactive DCs.
• Expand the agent row and hover over the status information icon next to a Degraded or Inactive status to read the specific error message. For an Inactive DC, check the Status Changed On timestamp to know when the failure began and cross-reference it with logs on that DC.
• Use the Export data icon to download the agent/DC report — the Inactivity Reason field gives diagnostic context for each agent and Domain Controller.
• Go to Monitoring > Events and filter Category: Active Directory to see status changes, polling errors, and sync events. Open the Details column for specifics.

Agent Shows Degraded or Inactive: Service Account and Credentials

An agent-wide Degraded or Inactive status most often indicates a problem with the Elisity service-account credentials.

Common causes:

• The service account is no longer a member of the Event Log Readers group.
• The account has lost the Log on as a service right (for example, after a GPO change overwrote local policy).
• The account password expired or was changed, or the account is locked out.
• Credentials were entered in the wrong format, or the Use gMSA Account option does not match the account type.

Resolution:

1. Confirm the service account is a member of the Event Log Readers group and still has the Log on as a service right (Local Security Policy > Local Policies > User Rights Assignment).
2. If the password changed, re-enter the credentials in Cloud Control Center: Settings > Active Directory > Agents, click the Actions menu (⋮) on the agent, and select Set Credentials. Enter the username as sld\username (for example, mydomain\elisitysvc), and select Use gMSA Account only if the account is a Group Managed Service Account.
3. After updating credentials, allow a few moments for the status to return to Active. Hover the status icon again to confirm the error has cleared.

A Domain Controller Shows Inactive: Permissions and Connectivity

When the agent is otherwise healthy but one or more Domain Controllers show Inactive, the agent cannot collect events from those Domain Controllers. Recall the status meanings:

Active: The AD Agent is actively collecting events from this Domain Controller.
Inactive: The AD Agent is not collecting events (for example, the service is stopped or the Domain Controller is unreachable).

Common causes and resolution:

• Missing Security log read permission on that DC — confirm the service account is in the Event Log Readers group as it applies to the affected Domain Controller.
• Audit policy / GPO not applied to that DC — verify the GPO audit settings described in the Connect Microsoft Active Directory guide have replicated to the DC, then run gpupdate /force on it. Without the correct Advanced Audit Policy settings, the DC will not generate the events the agent expects.
• Domain Controller unreachable — verify network connectivity between the agent host and the DC, including the LDAP/LDAPS path to the Sync Domain Controller and reachability to each Event Polling DC. Confirm no firewall change has blocked the required ports.
• DC decommissioned or renamed — if a monitored DC no longer exists, remove or update it under the agent's Configure Agent page (Domain Controllers tab).

Events Stop Processing for a Domain Controller

If a Domain Controller is reachable and permissioned but events still stop flowing, the issue is typically antivirus interference or corrupted agent state.

1. Check antivirus exclusions first. Antivirus or endpoint protection software blocking or quarantining files under C:\ProgramData\Elisity\ADAgent — particularly C:\ProgramData\Elisity\ADAgent\Cache\Versions — is a frequent cause of the AD Agent failing to start or update properly. Confirm the folder and process exclusions described in the Connect Microsoft Active Directory guide are in place on the affected host, and review the antivirus logs for blocked processes or quarantined files.
2. Restart the AD Agent service. Restarting the Elisity AD Agent Service on the affected host restores event collection for its monitored Domain Controllers. After the restart, watch Monitoring > Events (Category: Active Directory) to confirm event processing resumes.
3. Suspected corrupted agent state. The agent stores internal state files locally. If those files become corrupted, event processing can stall.

Agent Cannot Reach Cloud Control Center

If the agent shows a connectivity error, or you see a Cloud Access Failed message during install or reconfiguration, the host cannot reach Cloud Control Center.

• Outbound 443 blocked — the agent requires outbound port 443 to communicate with Elisity Cloud Control Center. Verify a firewall, proxy, or web filter has not blocked outbound HTTPS to the Gateway Server URL.
• Expired gateway credential — the Gateway Credential copied from Cloud Control Center is valid for 60 minutes after being generated. If onboarding stalled, return to the AD Agent configuration page, click VIEW CONFIGURATION INFORMATION, regenerate the credential, re-enter it, then click Test access.
• TLS version — Windows 10 and Windows Server 2016 do not natively support TLS 1.3. If your security requirements mandate newer TLS, host the agent on Windows Server 2019 or later.

Verify Recovery

After applying a fix, confirm the agent has fully recovered:

• The Agent Status returns to Active and previously Inactive Domain Controllers show Active (green indicator).
• The Status Changed On timestamp updates to reflect the recovery, and hovering the status icon no longer shows an error.
• Monitoring > Events (Category: Active Directory) shows AD events resuming, confirming user and device enrichment is flowing again.

When to Contact Elisity Support

Engage Elisity Support if:

• You suspect corrupted agent state and need guidance on how to clear it without forcing an unwanted re-registration.
• A Domain Controller continues to show Inactive or stops processing events after you have confirmed Event Log Readers membership, the Log on as a service right, audit/GPO settings, antivirus exclusions, and DC reachability.
• The agent and all Domain Controllers show healthy credentials, permissions, and connectivity, but events still do not process.
• You need the Elisity outbound destination details to configure a firewall or proxy allowlist.

When opening a case, include the agent name, the affected Domain Controller name(s), the Inactivity Reason from the export, the Status Changed On timestamp, and any relevant entries from Monitoring > Events.