Skip to main content

Connect Active Directory

Active Directory is on-prem, so Retrievy scans it through the Retrievy Agent running on a domain-joined Windows server inside your network. Once the agent is installed and registered, Active Directory scanning starts on the next daily run with no extra configuration. This page explains what gets scanned, what the agent needs on the AD side, and how to confirm the connection is healthy.

Before you start​

You need:

  • A domain-joined Windows server (Windows Server 2016 or later) where the Retrievy Agent for Windows is already installed.
  • The agent's host machine joined to the domain you want scanned. The agent auto-detects the domain from its host's domain membership; it does not have a domain picker.
  • A Retrievy workspace with SCM (Security Configuration Management) enabled, which is included on every plan.

How the connection works​

The agent runs as the Local System account on its host. Local System carries the machine's Kerberos identity, which means the agent authenticates to Active Directory as the host computer itself. There is no separate service account to create, no LDAP password to rotate, no API key to manage.

The machine account needs the standard Authenticated Users read access that any domain-joined computer already has. That covers:

  • User and group objects (for the stale admin, Kerberoasting, and group-nesting checks)
  • rootDSE and schema attributes (for domain functional level and LAPS detection)
  • The nTSecurityDescriptor on the domain root (for DCSync rights enumeration)
  • The SYSVOL share (for GPO X-Ray)

If your domain has Read access locked down beyond defaults, see Troubleshooting below.

What gets scanned​

The agent runs two separate AD scans on a schedule. Both are part of the SCM Active Directory module.

ScanWhat it looks atFindings land in
Active Directory CISAccount policies, password policies, audit settings, user rights assignment, registry hardening. Maps to CIS Microsoft Windows benchmarks.SCM Active Directory dashboard + Hardening Kanban
GPO X-RayEvery Group Policy Object in the domain. Surfaces unlinked GPOs, conflicting settings, dangerous delegations, and policy drift.Same dashboard, separate filter chip

Both scans run automatically on a daily cadence (CIS around midnight, GPO X-Ray around 01:30 server-local time). You don't schedule them yourself.

Step 1. Install the Retrievy Agent (if you haven't already)​

If the agent isn't on a domain-joined server yet, follow Install the agent on Windows. Come back here when Settings → Fleet → Agents shows the new agent with a green Online dot.

Step 2. Confirm the agent has detected your domain​

In Retrievy:

  1. Open Settings → Fleet → Agents.
  2. Find the agent for your AD server. Click the row to expand the detail.
  3. Look for the Detected Domain field. It should show the fully-qualified domain name (for example corp.acme.local).

If the field is empty, the host probably isn't domain-joined or joined to a workgroup. Re-join the host to the target domain, restart the Retrievy Agent Windows service from services.msc, and refresh the page after a minute.

Step 3. Trigger the first AD scan (optional)​

The scheduled scan runs once a day. To see findings immediately, click Trigger Scan on the agent row and pick Active Directory CIS from the scan-type dropdown. The agent picks up the command on its next heartbeat (usually within a minute) and the scan starts.

You can watch progress on the Recent Scans list at the bottom of the Command Center. When it completes, findings appear in the SCM Active Directory dashboard.

Step 4. Trigger a GPO X-Ray scan​

Same drill. On the agent row, click Trigger Scan again and pick GPO X-Ray. This one takes longer than the CIS scan because it walks every linked and unlinked GPO in the domain plus the SYSVOL files behind them.

What you see after the first scan​

The SCM Active Directory dashboard populates with:

  • A per-module score (the AD slice of your Retrievy Index).
  • A finding count broken down by severity.
  • The GPO X-Ray view, which is a separate tab on the same page, with its dedicated finding list.
  • Findings carry compliance mappings so they also show up in the Compliance Hub.

Multiple domains and multi-forest setups​

One agent scans one domain (the one its host is joined to). If you have:

  • Multiple domains in one forest: install one agent per domain on a host joined to that domain.
  • Multiple forests: same. One agent per forest, on a host joined to that forest.
  • A test/lab domain you don't want scanned: do not install the agent on a host in that domain. Retrievy never reaches across domain boundaries on its own.

There is no per-domain license slot today. Each agent counts as one data-source slot on your plan whether it's scanning AD, FortiGate, or both.

Pausing AD scans​

To pause scans without uninstalling the agent:

  1. Open the agent row in Settings → Fleet → Agents.
  2. Toggle Scans paused on. The agent keeps heartbeating but skips its scheduled scans.

To resume, toggle it back off. Scheduled scans pick up at the next cron interval.

Troubleshooting​

Symptom: Agent is Online but the Detected Domain field is blank. → Fix: The host isn't domain-joined, or the agent service is running as a non-domain account. Confirm whoami /domain returns your AD domain on the host. If it does and the field is still empty, restart the Retrievy Agent service in services.msc.

Symptom: First scan completes but every AD check reports AccessDenied or 0 objects returned. → Fix: Your domain has Authenticated Users read-access locked down past defaults. You'll need to grant the host's machine account read access to the domain naming context. The simplest fix is to add the host computer object to the built-in Pre-Windows 2000 Compatible Access group, which restores standard read defaults. Restart the agent service and re-trigger the scan.

Symptom: GPO X-Ray runs but reports zero GPOs. → Fix: The machine account can't read SYSVOL. Confirm the host can browse \\<your-domain-fqdn>\SYSVOL\<your-domain-fqdn>\Policies in Explorer. If it can't, your domain has restricted SYSVOL read; allow the host's machine account or the Authenticated Users group to read SYSVOL.

Symptom: CIS scan finishes but Account Policy findings look stale (don't match recent GPO changes). → Fix: The CIS scan reads the effective policy from the host the agent runs on. Run gpupdate /force on the agent's host to pull the latest GPO settings, then re-trigger the scan.

Symptom: I want to scan a child domain but the agent only sees the parent. → Fix: Install a second agent on a host joined to the child domain. One agent per domain is the supported model.