This article explains how to use System Center Operations Manager (SCOM) and a PowerShell script to inform you about missing Active Directory (AD) site IP address subnet allocations. In an Active Directory domain, clients use AD site information to determine the closest domain controller that manages the authentication. If the client is in an IP subnet not allocated to an AD site, a random domain controller authenticates the client, which can significantly slow down the logon process.

By default, you can only use VBScript to create monitors and rules. Because we will use PowerShell in this guide, you have to download and install the free, open-source PowerShell Community Management Pack on GitHub.

PowerShell script to parse netlogon.log ^

Crucial for our script is the log file netlogon.log located in C:\Windows\debug\ that contains information about clients with missing subnet allocations. A typical record could look like this:

The following script parses the log file and stores all entries of the current day in a list. If there is an entry in the list, it will send the overthreshold state to SCOM and underthreshold if not.

Creating the SCOM alert rule ^

With the help of our PowerShell script, we can now create a new SCOM rule. In the SCOM Management Console, switch to the Authoring pane, expand Management Pack Objects, and right-click on Rules. Choose Create a New Rule.

Expand Alert Generating Rules and PowerShell Based. Select PowerShell Script Alert Generating Rule (Community), and click on New to create new management pack (MP) to store the configuration in.

Select PowerShell Script Alert Generating Rule and click on New

Select PowerShell Script Alert Generating Rule and click on New

Use a descriptive name for the management pack, such as ActiveDirectory.Custom.RulesAndMonitors. This helps keep an overview of MPs.

Maintain the name and description of the management pack

Maintain the name and description of the management pack

Optionally, maintain additional content as part of the knowledge component of each MP. Proceed by clicking on Create.

Optional: add MP knowledge and click Create

Optional: add MP knowledge and click Create

Back in the rule wizard click on Next to proceed with rule authoring.

In the rule wizard, proceed with Next

In the rule wizard, proceed with Next

Enter a rule name such as Discover Active Directory Missing IP Range <-> Site Allocations, a description, and choose the rule target. The rule target defines on which computers the rule will execute. In our case it must be the Windows domain controller.

Name the rule and target the Windows Domain Controller

Name the rule and target the Windows Domain Controller

In the Schedule section choose twice a day for example.

Schedule the rule execution time

Schedule the rule execution time

In the Script section choose a file name, for instance, Parse-NetlogonLog.ps1. Set the timeout to two minutes and paste in the script from above. Proceed with Next.

Choose a script name and paste the content

Choose a script name and paste the content

Keep the Criteria section unchanged and proceed with Next.

Leave the criteria unchanged

Leave the criteria unchanged

Last, configure the alert with a severity of Warning and the Alert description containing a least the following information:

Configure the alert description and severity

Configure the alert description and severity

Creating a new alert view ^

Next, we have to create a new alert view about missing IP subnet allocations.

Change to the Monitoring pane, right-click the ActiveDirectory.Custom.RulesAndMonitors container, and select New –> Alert View.

Build the alert view

Build the alert view

Name it Missing IP Range <-> Site Allocations for example. Specify the target Windows Domain Controller and filter it to show only those alerts with the string %Active Directory Missing IP Range%.

Configure the alert view

Configure the alert view

After a while, all domain controllers will have downloaded the management pack. This screen will show the first alerts.

Alert view showing Missing IP Range Site Allocations

Alert view showing Missing IP Range Site Allocations

If you have questions, please post a comment below.

Read 4sysops without ads by becoming a member!

Your question was not answered? Ask in the forum!

3+
Share
1 Comment
  1. Arpita Dhawan 2 years ago

    Hi,

    This post is really very helpful. Thanks

    2+

    Users who have LIKED this comment:

    • avatar

Leave a reply

Your email address will not be published. Required fields are marked *

*

© 4sysops 2006 - 2020

CONTACT US

Please ask IT administration questions in the forums. Any other messages are welcome.

Sending

Log in with your credentials

or    

Forgot your details?

Create Account