Warning: Missing Required Data Needed to build the AD Object Lookups

The MS Windows AD Objects application can not complete the configuration because required data is missing. Review the below troubleshooting steps to resolve the issue.

Missing Active Directory Domain Details - Troubleshooting Steps

In order to build the AD Object Lookups leveraged by this application, AD Domain details need to be either collected or manually entered. Below are the two options for either collecting the data used to automatically gather the AD Domain information or Manually Entering this data.

Option 1: Auto Build using Collected ActiveDirectory Topology data:

Follow the below troubleshooting Steps for resolving the issue of missing the required Domain Health data

  • Make Sure that atleast one (Depends on Windows OS Version) of the following inputs is enabled on the Active Directory Domain Controllers:
  • If you renamed the Splunk pre-configured TA that was provided by the MS Windows AD Objects application (Splunk_TA_windows_dc), or you are using a different TA to collect the sourcetype=MSAD:NT6:Health data, then make sure you have updated the [powershell://AD-Health] input with the updated TA name for the script setting.
  1. Login to one of your AD Domain Controllers
  2. Open File Explorer and navigate to ...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_dc\local directory.
  3. Running Wordpad in "RunAs Administrator" mode, open the inputs.conf file.
  4. Search for the [script://.\bin\runpowershell.cmd nt6-health.ps1] input stanza
    • The MSAD Health data inputs are dependent on the Windows Version. See the below input settings to determine which one needs to be enabled:
      • Health and Topology Information Windows (Version 2008):
        			[script://.\bin\runpowershell.cmd nt6-health.ps1]
			source=Powershell
			sourcetype=MSAD:NT6:Health
			interval=300
			disabled=0
			index=msad
      • >Or Health and Topology Information Windows (Version 2012r2 and 2016 +):
        			[powershell://AD-Health]
			script = & "$SplunkHome\etc\apps\Splunk_TA_windows_dc\bin\Invoke-MonitoredScript.ps1" -Command ".\powershell\2012r2-health.ps1"
			schedule = 0 */5 * ? * *
			source=Powershell
			sourcetype=MSAD:NT6:Health
			disabled=0
			index=msad
  5. Make sure the disabled setting is set to disabled = 0 for input that matches your Windows Version
  6. Also, double check that the index setting matches the index that you created for your AD Data
  7. Last check, if you are using a different name then Splunk_TA_windows_dc then you will need to update the script setting, (script = & "$SplunkHome\etc\apps\Splunk_TA_windows_dc\bin\Invoke-MonitoredScript.ps1" -Command ".\powershell\2012r2-health.ps1" to the name you are using for the TA's folder.
  8. If you made any changes then Restart the Splunk Forwarder Service
  1. Login to one of your Splunk Deployment Server
  2. Using terminal or File Explorer and navigate to ...\Splunk\etc\deployment-apps\Splunk_TA_windows_dc\local directory.
  3. Open the inputs.conf file.
  4. Search for the [script://.\bin\runpowershell.cmd nt6-health.ps1] input stanza
    • The MSAD Health data inputs are dependent on the Windows Version. See the below input settings to determine which one needs to be enabled:
      • Health and Topology Information Windows (Version 2008):
        			[script://.\bin\runpowershell.cmd nt6-health.ps1]
			source=Powershell
			sourcetype=MSAD:NT6:Health
			interval=300
			disabled=0
			index=msad
      • >Or Health and Topology Information Windows (Version 2012r2 and 2016 +):
        			[powershell://AD-Health]
			script = & "$SplunkHome\etc\apps\Splunk_TA_windows_dc\bin\Invoke-MonitoredScript.ps1" -Command ".\powershell\2012r2-health.ps1"
			schedule = 0 */5 * ? * *
			source=Powershell
			sourcetype=MSAD:NT6:Health
			disabled=0
			index=msad
  5. Make sure the disabled setting is set to disabled = 0 for input that matches your Windows Version
  6. Also, doublecheck that the index setting matches the index that you created for your AD Data
  7. Last check, if you are using a different name then Splunk_TA_windows_dc then you will need to update the script setting, (script = & "$SplunkHome\etc\apps\Splunk_TA_windows_dc\bin\Invoke-MonitoredScript.ps1" -Command ".\powershell\2012r2-health.ps1" to the name you are using for the TA's folder.
  8. If you made any changes then open a command line/terminal and navigate to ...\Splunk\bin\ directory and run the following command: 
    splunk reload deploy-server
Option 2: Manually enter AD Domain Details:

Follow the below troubleshooting Steps for manually entering in the required Active Directory Domain details into the AD_Obj_Domain lookup table.

  1. Click Open Add Domain Form to open the manual Domain Input form below.
  2. Enter the AD Details into all of the input fields.
    • DC Host Name: This is the name of one of the AD Domain Controllers for the Domain.
    • Forest FQDN:This is the Root level Fully Qualified Name. (Ex: testdemo.local)
    • Domain FQDN:This is the Domain level Fully Qualified Name. (Ex: contoso.testdemo.local)
    • Domain NetBIOSName:This is NetBIOSName for the Domain. A Simple example is when a user logs in; for example a user logs in with Contoso\joe_user, the NetBIOSName is Contoso
    • Domain Site Name:This is the Site Name for the AD Domain. (Ex: Default-First-Site-Name)
  3. Click the Add Above Values button after entering in the required values for the individual AD Domain.
  4. Repeat the Steps for each Active Directory Domain.
  5. After Entering in All of the required values for All of your target Active Directory Domains click the Rerun Check button below to open the Lookup Builder table.

Missing Active Directory admon Sync data - Troubleshooting Steps

To ensure that all of the Active Directory Objects are collected, and not just the Updated, Created, or Deleted ones, admon baseline data needs to be collected.

This troubleshooting step is shown because admon "Sync" data was not found in the last 30days. Follow the below steps to either adjust the time period to search for the sourcetype="ActiveDirectory" admonEventType="Sync" data, or to update/verify the [admon://default] input enabled on one of your AD Domain Controllers.

First: Get Last Sync Time and Update Time Period Selection:

Use the Sync Time Helper

  • Retrieve the latest admon Sync Event Time:
    1. Click Use Sync Time Helper
      .
    2. It is important that you get the last time the admon baseline was collected, to ensure that all of the AD Objects (User/Group/Computer/OU/GPO) are added to the lookup.
    3. Set the TimeSelector Date Range - - Begin From - - Date Value with value in the Recommended_Sync_Start_Day Column and set the End Date for today.
  • Follow the Option 2: Steps below for verifying or updating the admon input.

  • If you have a large AD Object count environment, and the building process is taking too long, it is recommended follow the steps outlined in the Steps for Recollecting admon Base Line Data to recollect the "Baseline" admon data for the individual Splunk Forwarder that is collecting admon data.
  • This will allow you to select a shorter time range for picking up the Sync data used to build the Lookups.

Time Helper Results
Message: $tok_time_helper_msg$
First Time for Sync Data: $tok_time_helper_f_time$
Last Time for Sync Data: $tok_time_helper_l_time$
Second: Verify/Update admon input:
  • After performing the below steps, Wait about 15 - 30m, depending on the size and Domain count, before clicking the Rerun Autocheck button.

The below steps walk through the quick process of recollecting the required: admon baseline data.

  • The admon baseline data is Only collected the first time the input is enabled.
  • Make sure you do not have the [admon://....] data input enabled in any of the other TA's or in the \etc\apps\SplunkUniversalForwarder\local\inputs.conf. It should only be enabled in one place, otherwise the baseline setting could possible be overridden.
  1. Login to the AD Domain Controller you deployed the Splunk_TA_windows_admon TA too.
  2. Stop the Splunk Forwarder Service
  3. Open File Explorer and navigate to ...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows_admon\local directory.
  4. Running Wordpad in "RunAs Administrator" mode, open the inputs.conf file.
  5. Verify that the [admon:\\default] input is enabled. See the below example: 
    	[admon://default]
	disabled = 0
	monitorSubtree = 1
	baseline = 1
	index=msad
  6. If it wasn't enabled, then enable it (ie. disabled = 0) and save the changes.
  7. Navigate into the ...\SplunkUniversalForwarder\var\lib\splunk\persistentstorage\ADMon\ directory.
  8. Delete the default.ini file.
    • If you see more than one file then you must have admon input enabled in either ...\SplunkUniversalForwarder\etc\system\local or in one of the applications under ...\SplunkUniversalForwarder\etc\apps directory.
    • You can also run the command splunk cmd btool inputs list admon://default --debug from a command line, where you are executing from the ...\SplunkUniversalForwarder\bin directory.
    • Once you find where it is enabled, then delete the complete [admon:\\...] input stanza from that location.
  9. Start the Splunk Forwarder Service