Active Directory (on-prem)

Purpose

On-prem Active Directory integration reads domain user, group and Group Policy state through a lightweight collector-side query so AssurIQ can assess password policy, stale accounts, privileged group membership and legacy protocol exposure alongside cloud identity evidence.

Requirements

• A domain-joined Windows host or the AssurIQ collector reachable to a domain controller
• A dedicated read-only service account (no interactive logon rights needed)
• LDAP/LDAPS (389/636) reachability from the collector to at least one domain controller per domain

Permissions

• Domain user account with default Domain Users read rights (no elevated group membership required)
• Read access to Group Policy Objects via SYSVOL for policy evidence
• Optional: Event Log Readers group membership for authentication event evidence

Setup

1. 1
   Create the service account

   Create a standard domain user account dedicated to AssurIQ with a long, rotated password.
2. 2
   Grant read access

   Confirm the account has default read access to the domain naming context; no delegated admin rights are granted.
3. 3
   Add credentials to the vault

   Store the account in AssurIQ's Credential Vault scoped to the customer and site.
4. 4
   Enable the AD assessment

   In Integrations, enable Active Directory for the site and select the credential.
5. 5
   Run initial collection

   Trigger the first collection cycle and confirm domain, OU and group data populate.

Verification

• Active Directory Assessment page shows a recent collection timestamp
• Privileged group membership (Domain Admins, Enterprise Admins) matches the known roster
• Password policy and stale-account findings appear under Identity Security

Data collected

• Domain users, groups and organizational units
• Privileged group membership (Domain Admins, Enterprise Admins, Schema Admins)
• Password and lockout policy settings
• Stale and disabled account indicators
• Group Policy Object inventory

Security model

AssurIQ uses a standard, non-administrative domain account over LDAP/LDAPS from the on-prem collector. No credentials are transmitted outside the customer network in plaintext; the collector sends only evidence over outbound mTLS. The account cannot modify directory objects.

Common errors

• AIQ-CRD-001Credentials failing
  Stored credentials were rejected by one or more targets.
• AIQ-INT-001Integration disconnected
  The connector token expired or was revoked. Data from this system is stale.

Troubleshooting

• If group membership looks incomplete, confirm the collector can reach a Global Catalog server for multi-domain forests.
• If policy data is missing, confirm SYSVOL is reachable and the account has default read access.
• Account lockouts usually indicate a stale cached credential on the collector host; update and retest.

Disconnect

1. Disable the Active Directory integration for the site in AssurIQ.
2. Disable or delete the dedicated service account in Active Directory.
3. Dependent identity controls move to EVIDENCE GAP on the next cycle.