banshee/active-directory-collection/active-directory/winrm/dc-services

Services of a domain controller, by WinRM

Returns the state of each service a domain controller runs: Active Directory Domain Services, Netlogon, the Kerberos Key Distribution Center, the DNS Server, the Windows Time service and DFS Replication. Two watches are proposed, both checked: a service that does not run, and a service that is not installed.

Versions

A domain controller running Windows Server 2012 or later, with Windows PowerShell 3.0 or later, as the prerequisites name them. Generic: no folder of version. That every release answers alike is assumed, not yet checked on a real domain controller.

How it works

The collector runs one PowerShell script, by WinRM, that reads Win32_Service, one object per service, and keeps the six services of a domain controller:

[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding; ConvertTo-Json -Compress -Depth 4 -InputObject @{services = @(Get-CimInstance Win32_Service | Where-Object { @('NTDS', 'Netlogon', 'Kdc', 'DNS', 'W32Time', 'DFSR') -contains $_.Name } | Select-Object Name, State)}

WinRM hands the script to PowerShell itself: the script is the one of active-directory/ssh/dc-services, without the powershell -Command "…" that cmd.exe needs there.
The services, by their service name, the same in every language of Windows:

Service	Name
Active Directory Domain Services	`NTDS`
Netlogon	`Netlogon`
Kerberos Key Distribution Center	`Kdc`
DNS Server	`DNS`
Windows Time	`W32Time`
DFS Replication, which replicates SYSVOL	`DFSR`

The names are those that dcdiag checks in its Services test (Microsoft, "dcdiag"). A name is matched whatever its case, and given back as written in the table.

The state is written by WMI in English whatever the language of the system, and returned in lower case, words joined by -: running, stopped, start-pending, stop-pending, paused.
None of the six services installed, or an answer that is not the expected JSON, stops the collector as misconfigured: the host is not a domain controller.

Nothing is written to the Windows: the script only reads.

Prerequisites

A domain controller running Windows Server 2012 or later, with Windows PowerShell 3.0 or later (3.0 on Server 2012, 4.0 on 2012 R2, 5.1 from 2016 on).
The WinRM service listening in HTTPS, on TCP 5986 or the port set in protocol:winrm:port, open in the Windows firewall to the poller, with a certificate the poller judges by the TLS profile of the probe or pins in protocol:winrm:fingerprint: the steps are those of the windows/winrm/services collector of banshee/windows-collection.
NTLM authentication, which the WinRM service accepts as installed: the password never travels.
An account of the domain for monitoring, without administrator rights, set in protocol:winrm:user (DOMAIN\account or account@domain) with its password in protocol:winrm:password, member of the group "Remote Management Users" of the domain (on a domain controller, the built-in group of the Builtin container), which opens WinRM to an account that is not an administrator. No other group: Win32_Service is open to any account.

Outputs

Name	Label	Unit	Per instance
`state`	State	—	yes, per service

Watches

Name	Title	Kind	Defaults	Checked by default
`stopped`	Service stopped	expected value, on `state`	critical when the state is anything but `running`	yes
`missing`	Service missing	expected instances, on `state`	critical when one of `NTDS`, `Netlogon`, `Kdc`, `DNS`, `W32Time`, `DFSR` is not installed	yes

A domain controller that does not serve DNS takes DNS out of "Service missing" on the probe.

Limits

On a domain whose SYSVOL is still replicated by FRS, DFS Replication is installed but not used; its state says nothing of SYSVOL. The sysvol collector says which one replicates it.
Not yet checked on a real domain controller: the execution; that "Remote Management Users" of the domain is enough to open WinRM on a domain controller.