Integration
Active Directory
Domain controller events: directory service and replication, DNS Server, DFS Replication and AD Web Services. Add Windows Security for logons.
- Category: Identity and SaaS
- How data is sent: Logthread Agent
- Runs on: Windows Server
- Status: Beta
How it works#
- Answer a few questions. They only fill in the setup steps. Nothing on this page connects to your servers: Logthread never reaches into your network.
- Run one command on the Active Directory machine. The next page shows the command with this connector's ingest key filled in. It downloads the Logthread Agent from downloads.logthread.com and installs it as a service (Windows Server, in PowerShell as Administrator). No other download.
- Data arrives. Everything is collected inside your environment. It is sent over outbound HTTPS (port 443) to ingest.logthread.com. Nothing is opened to the internet: no inbound ports, VPN or public access to your servers. The connection page shows what has arrived and turns Active with the first record.
What you answer#
| Question | Answer | Notes |
|---|---|---|
| Labels (optional) | Text | For Fleet and filtering, for example env=prod. |
| Manage this agent from Fleet | Yes or no | Change its configuration from Logthread later without logging in to the host. Default: Yes. |
Setup#
These are the steps for the default answers. In the app, they follow your answers, and the connector's ingest key replaces YOUR_INGEST_KEY.
Step 1. Install the Logthread Agent. In PowerShell as Administrator on the server: it installs the agent as a service with the Windows Server profile and the domain controller channels (Directory Service, DNS Server, DFS Replication, AD Web Services). Event data (the named fields that carry names and addresses) is not sent; the message, provider, event id, level and task are.
& ([scriptblock]::Create((irm https://downloads.logthread.com/agent/install.ps1))) -Key YOUR_INGEST_KEY -Profiles windows-server,windows-ad -FleetStep 2. Wait for data. New events show up within seconds; the agent starts from the present, not from the archive.
Check that it works#
The connection page under Integrations counts what has arrived and turns Active with the first record. In Explore, search service:windows-ad.
Then add#
Each is one click on the connection page and opens with your data, so you can check it before saving.
- Dashboard: Windows Server: CPU, memory, paging, disk, network, file systems and processes from the Logthread Agent windows-server profile.
- Alert: Active Directory errors:
service:windows-ad severity:(error|fatal), at least 3 in 10 minutes - Alert: AD replication problems:
service:windows-ad windows.event.provider:(*NTDS* OR *DFSR*) severity:(warn|error|fatal), at least 1 in 10 minutes
Set it up under Integrations in the app, or from an AI agent with MCP (add_integration). All integrations: Integrations guide. Next: find what it sends in Explore and live tail.