banshee/active-directory-collection/active-directory/ssh/dc-services

Services of a domain controller, by SSH

Returns the state of each service a domain controller runs: Active Directory Domain Services, Netlogon, the Kerberos Key Distribution Center, the DNS Server, the Windows Time service and DFS Replication. Two watches are proposed, both checked: a service that does not run, and a service that is not installed.

Versions

A domain controller running Windows Server 2012 or later, with Windows PowerShell 3.0 or later, as the prerequisites name them. Generic: no folder of version. That every release answers alike is assumed, not yet checked on a real domain controller.

How it works

The collector runs one PowerShell command that reads Win32_Service, one object per service, and keeps the six services of a domain controller:

powershell -NoProfile -NonInteractive -Command "[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding; ConvertTo-Json -Compress -Depth 4 -InputObject @{services = @(Get-CimInstance Win32_Service | Where-Object { @('NTDS', 'Netlogon', 'Kdc', 'DNS', 'W32Time', 'DFSR') -contains $_.Name } | Select-Object Name, State)}"

The services, by their service name, the same in every language of Windows:

Service	Name
Active Directory Domain Services	`NTDS`
Netlogon	`Netlogon`
Kerberos Key Distribution Center	`Kdc`
DNS Server	`DNS`
Windows Time	`W32Time`
DFS Replication, which replicates SYSVOL	`DFSR`

The names are those that dcdiag checks in its Services test (Microsoft, "dcdiag"). A name is matched whatever its case, and given back as written in the table.

The state is written by WMI in English whatever the language of the system, and returned in lower case, words joined by -: running, stopped, start-pending, stop-pending, paused.
None of the six services installed, or an answer that is not the expected JSON, stops the collector as misconfigured: the host is not a domain controller.

Nothing is written to the Windows: the command only reads.

Prerequisites

A domain controller running Windows Server 2012 or later, with Windows PowerShell 3.0 or later (3.0 on Server 2012, 4.0 on 2012 R2, 5.1 from 2016 on).
The OpenSSH server of Windows, installed and started (built in from Windows Server 2019, the Win32-OpenSSH release of Microsoft before), its default shell left at cmd.exe, the Windows firewall open to the poller on TCP 22, and the fingerprint of its host key set in protocol:ssh:fingerprint unless the Security settings trust the first SSH fingerprint presented: the steps are those of the windows/ssh/services collector of banshee/windows-collection.
An account of the domain for monitoring, without administrator rights, set in protocol:ssh:user, with its password in protocol:ssh:password or its key in protocol:ssh:private-key. No group: Win32_Service is open to any account.

Outputs

Name	Label	Unit	Per instance
`state`	State	—	yes, per service

Watches

Name	Title	Kind	Defaults	Checked by default
`stopped`	Service stopped	expected value, on `state`	critical when the state is anything but `running`	yes
`missing`	Service missing	expected instances, on `state`	critical when one of `NTDS`, `Netlogon`, `Kdc`, `DNS`, `W32Time`, `DFSR` is not installed	yes

A domain controller that does not serve DNS takes DNS out of "Service missing" on the probe.

Limits

On a domain whose SYSVOL is still replicated by FRS, DFS Replication is installed but not used; its state says nothing of SYSVOL. The sysvol collector says which one replicates it.
Not yet checked on a real domain controller: the execution; which right of a domain controller lets an account that is not an administrator open an SSH session there (the user rights "Allow log on locally" or "Access this computer from the network", depending on how the OpenSSH server logs the account on).