Active Directory collection failures

After every internal scan that includes Active Directory, RECON records the outcome of the collection for each domain and, if something goes wrong, tells you why and how to fix it. This guide covers every possible reason.

From 0:50 the video covers the basic checks when Active Directory returns nothing: the domain controller must be reachable on port 389 or 636, and the credentials must be valid.

Symptoms

In the internal scan, on the Active Directory tab, you see one of these notices:

• Red Active Directory was not collected banner: the collection failed, there is no data and no posture score is shown.
• Amber Active Directory was only partly collected banner: some parts of the directory are missing. The posture is shown with the label "Based on incomplete data", and the banner lists the missing parts under Not fully collected.
• The note "The latest collection attempt (date) failed. The results below are from the last successful collection.": a newer attempt failed, but RECON keeps showing you the last good collection.
• Collection status unknown: the result comes from an older probe version that does not report a detailed status.

With several probes or domains, the domain switcher can also show one of these for a probe: AD not configured, AD not requested, AD collection pending or AD collection failed.

Causes

How RECON rates a collection

Every collection has a status: succeeded, partial or failed. The probe reads the directory in ten modules: Domain root, Users, Computers, Groups, Organizational units, Group policies, Trusts, Permissions (ACLs), Certificate Services and SYSVOL. Each module ends up Collected, Failed, Access denied or Skipped.

• Skipped means "not applicable" (for example, AD CS is not installed) and never makes a collection partial.
• If one or more modules are Failed or Access denied, the collection is partial.
• If both the domain root and the users fail, or the probe cannot connect or sign in, the collection has failed.

Rules that protect you from wrong data

• A failed collection is never shown as a clean directory with zero findings: it has no posture score.
• A newer failed attempt never wipes out the last good collection for the same probe and domain: you see the earlier data with the note about the latest attempt.
• A failed collection is not counted in your account's usage.
• The probe collects Active Directory after it has sent the network scan results, with up to 5 minutes per domain. That is why, once the scan has completed, RECON waits 5 to 20 minutes (5 minutes per connected domain) before it reports AD collection failed; until then you see AD collection pending.

Possible reasons

Solutions

For every reason, RECON shows the text under How to fix. You change credentials and the domain controller on the probe: Internal Probes, the probe's menu, Edit, Active Directory tab. After each fix, run the scan again.

No directory account

What you see: "No directory account was available to the probe when the scan ran."

How to fix: "Add a read-only directory account in Edit probe → Active Directory, then run the scan again." If the credential already shows as connected, click Resync credential and run the scan within 15 minutes.

Name does not resolve in DNS

What you see: "The probe could not resolve the domain or domain controller name in DNS."

How to fix: "Make sure the probe uses your internal DNS servers (the ones that serve the AD zone), or enter the domain controller's IP address in the probe's Active Directory settings." The Domain, IP, or hostname field accepts the controller's IP directly.

Domain controller not found

What you see: "No domain controller could be located for this domain."

How to fix: "Check the domain name in the probe's Active Directory settings and that the _ldap._tcp SRV records resolve from the probe, or set the domain controller host explicitly."

Domain controller unreachable

What you see: "A domain controller was found, but the probe could not connect to it over LDAP."

How to fix: "Allow TCP 636 (LDAPS), or TCP 389 with StartTLS, from the probe to the domain controller on every firewall in between."

No encrypted channel

What you see: "The probe could not open an encrypted LDAP channel (LDAPS, StartTLS and NTLM sealing all failed). It never sends credentials over an unencrypted connection."

How to fix: "Enable LDAPS on the domain controller (install a server certificate) or allow StartTLS on port 389, then run the scan again."

TLS error

What you see: "The TLS handshake with the domain controller failed (certificate or protocol problem)."

How to fix: "Check that the domain controller's LDAPS certificate is valid (not expired, matching host name) and that TLS 1.2 or later is enabled."

LDAP signing required

What you see: "The domain controller requires LDAP signing that the probe could not provide on this channel."

How to fix: "Enable LDAPS (port 636) on the domain controller so the probe can sign in over an encrypted, signed channel."

Channel binding required

What you see: "The domain controller requires LDAP channel binding and rejected the probe's sign-in."

How to fix: "Make LDAPS available on the domain controller and update the probe to the latest version. If the error persists, contact support with the technical details."

Credentials rejected

What you see: "The domain controller rejected the directory account's username or password."

How to fix: "Re-enter or resync the collector credential in the probe's Active Directory settings (Edit probe → Active Directory), then run the scan again." If the collector account was deleted, or its password was changed in Active Directory, remove the connection and connect it again.

Account disabled, locked out or expired

What you see: "The directory account is disabled, locked out or expired, or its password has expired."

How to fix: "Ask your AD administrator to unlock or re-enable the account (or reset its password), then update it in the probe's Active Directory settings."

Directory root unreadable

What you see: "The probe signed in, but could not read the directory root or the user list."

How to fix: "Make sure the account is a normal domain user (member of Domain Users) and that its read access to the domain has not been restricted."

Access denied to some parts

What you see: "The probe signed in, but the account was denied read access to some parts of the directory."

How to fix: "Grant the collector account read access to the denied areas listed below (a standard Domain Users account is enough for most of them), then run the scan again." The denied areas are the modules marked Access denied.

Some parts not collected

What you see: "The probe signed in, but some parts of the directory could not be collected."

How to fix: "Run the scan again. If the same parts keep failing, check the stability of the connection to the domain controller and contact support with the technical details."

Ran out of time

What you see: "The collection ran out of time before it finished."

How to fix: "Run the scan again at a quieter time and check the latency between the probe and the domain controller. Very large directories may need a probe closer to a domain controller."

Collector stopped

What you see: "The Active Directory collector stopped unexpectedly."

How to fix: "Update the probe to the latest version and run the scan again. If it happens again, contact support with the technical details."

Unexpected reason

What you see: "The collection failed for an unexpected reason."

How to fix: "Run the scan again. If it fails again, contact support with the technical details below."

Per-probe status in the domain switcher

• AD not configured: the probe has no directory account. Connect one from the probe's Active Directory tab.
• AD not requested: the scan had Include Active Directory turned off. Leave it on for the next scan.
• AD collection pending: the collection has not arrived yet. It appears as soon as the probe uploads it.
• AD collection failed: the probe has an account, but the collection did not complete and nothing arrived. Check that the probe is online and can reach the domain controller, then run the scan again.

Prevention

• Keep the probe up to date: with older versions RECON infers the status from the coverage data and cannot give you the exact reason.
• Make sure the probe uses your internal DNS servers and reaches the domain controllers on port 636, or on 389 with StartTLS.
• Use the collector account the probe created, and do not disable it or change its password in Active Directory.
• After connecting or changing a domain, run a scan within 15 minutes, or use Resync credential.

Contact support

If the problem persists, open Show technical details in the banner and attach the text to your request. The detail contains the collection's error message: for a rejected sign-in, usually the code returned by the domain controller (for example data 52e) with the controller's name or IP; for a partial collection, the list of failed modules with their codes. RECON strips passwords, hashes and other secrets from the text and caps it at 300 characters.