Connect Active Directory to the Scout probe

Once Active Directory is connected, the Scout probe maps the users, groups, computers and permissions in your domain, always read-only. You enter a domain admin just once: the probe creates a dedicated read-only account and the admin password is discarded.

Goal

Connect the meccanicaadda.local domain to the stabilimento-treviglio probe, so that every internal scan also collects Active Directory.

Prerequisites

• The probe is installed and shows as Online. If it is offline, RECON will not start the connection and shows: "The probe is not online yet. Install and start it first — Active Directory connects once the probe is live so your admin password is delivered securely."
• You own the probe: only the owner can connect or change Active Directory.
• The probe can reach a domain controller over LDAPS (TCP 636), or over LDAP (TCP 389) with StartTLS. For domain controllers without a certificate, the probe can fall back to NTLM sealing on port 389 (password only). A cleartext channel is never used.
• You have the credentials of a domain admin (password or NT hash). You need them only once.

Steps

1. Open the probe settings

   In the sidebar, open Internal Probes. Find the stabilimento-treviglio probe in Gruppo Meccanica Adda, open its menu and choose Edit.

2. Go to the Active Directory tab

   Select the Active Directory tab. The Connect Active Directory panel explains: "Enter a domain admin once. RECON creates a dedicated read-only account and discards your admin password."

3. Enter the domain

   In Domain, IP, or hostname, type meccanicaadda.local: the probe finds a domain controller through DNS. If the domain DNS is broken or still points to a decommissioned controller, enter the IP or hostname of a domain controller instead to connect directly.

4. Enter the administrator

   In Administrator, type the username in the DOMAIN\user form, and its password in Password. If you only have the account's NT hash, click use NT hash and paste the 32-character hex hash.

5. Connect

   Click Connect Active Directory. "Creating your read-only account…" appears: the probe signs in as the admin, creates the collector account, then discards the password. It takes about 30 seconds.

What happens after you click

• RECON encrypts the admin password with AES-256-GCM, using a key specific to that probe, and hands it to the probe only while the probe is online.
• The encrypted copy stays on the server for a few minutes at most: once the result arrives, or when it expires, it is overwritten and deleted.
• The probe opens it in memory only, connects to the domain controller over an encrypted channel and creates a dedicated account whose name starts with svc-orizon-recon. It is a plain domain user, with no privileged group memberships.
• In the same run, the probe tries to delegate read access to LAPS passwords to that account. If the domain does not use LAPS, the account is still fully usable.
• The admin password is never stored in clear and never written to the probe's disk. The RECON audit log records only the admin's username, never the password.

Use a read-only account you already have

The probe's primary domain is connected with the steps above. To collect more domains from the same probe, use Add another domain at the bottom of the tab: enter Domain, IP, or hostname, Collector username and its password, then click Add domain. In this case nothing is created in your directory.

Result

• The probe's Active Directory tab shows "Active Directory connected", with the account mode and the coverage. From here you can use Re-check coverage and Resync credential.
• In the internal scan, open the Active Directory tab, pick the domain and open Coverage: you see the collector account (a read-only domain user) and which reads are granted, for example whether Read LAPS passwords is available.

What the probe reads on every scan

After the network scan, if the scan's Include Active Directory option is on, the probe uses the read-only account to read:

• users, groups, computers and organizational units;
• group policies (GPOs) and the contents of SYSVOL, read-only;
• domain trusts;
• object permissions (ACLs);
• AD CS certificate templates and certificate authorities.

The collection never writes anything to the directory and has 5 minutes per domain.

Troubleshooting

• "Connection failed": RECON shows the reason. Check the admin credentials and that the probe can reach the domain controller, then retry.
• Connected, but scans show no Active Directory: click Resync credential, then run a scan within 15 minutes.
• The collection fails or is partial: the scan's Active Directory tab shows the reason and how to fix it. Every case is listed in the collection failures guide.

Related articles