Active Directory

RMM → Active Directory shows one customer's Windows domain. Open a customer first: the page is in customer mode only, and it appears in the sidebar once the customer has a domain. Revo only reads the directory; it changes nothing in it.

How a domain gets here

Install RevoAgent 0.13 or later on one of the customer's domain controllers. Its next inventory report says which domain it belongs to, and the domain appears with its first read due straight away. Nothing else to set up: no credentials, no service account.

With several domain controllers, one of them reads the domain (the collector). Revo prefers a domain controller that checked in during the last hour, then the PDC emulator, then the one seen most recently. If the collector's last two reads failed, another one takes over at the next read. Install RevoAgent on more than one domain controller and a read never waits for a single server.

A read runs every 4 hours, and Sync now in the page header asks for one at once (it waits while another is already waiting or running). If no domain controller can read, the page says why: RevoAgent is too old, or the customer turned directory off in RevoAgent's local settings on the domain controller.

What's read

Users (names, logon names, email, enabled, last logon, title, department, OU), and while RevoRMM is on for the customer: lockout and password state, groups and their direct members, OUs, and computer accounts. RevoAgent asks AD for a fixed list of attributes and never for passwords, password hashes, LAPS passwords or BitLocker keys.

Last logon comes from lastLogonTimestamp, which AD replicates only every 9 to 14 days, so it can be up to two weeks behind. Inactive means no logon for 90 days.

The tabs

• Overview: the counts, what needs attention (locked out, inactive users, passwords that never expire, computers without RevoAgent, inactive computers), the domain's facts and domain controllers, billing, and the latest changes.
• Users and Computers: the OU tree beside the list filters to an OU and everything below it. The chips filter by state. Click a row for its quick look: groups, manager, password state, the Microsoft 365 account synced from it (when the customer's tenant is linked), and its identifiers.
• Groups: privileged groups first (Domain Admins, Enterprise Admins, Schema Admins, Administrators, the operator groups and anything AD protects with adminCount). A group's quick look lists its direct members; a nested group is listed, and opens on its own.
• Computers without RevoAgent (a chip on Computers): enabled computer accounts that signed in during the last 30 days and have no Revo device. A Revo device matches a computer when it's the same customer's, joined to this domain, with the same host name. This is where a RevoAgent rollout usually leaks.
• Changes: see below.
• Reports: inactive users and computers, passwords that never expire, locked out, privileged access, group membership, computers without RevoAgent and AD changes, each as a table and a CSV.

The change timeline

Each read is compared with the one before: users created, deleted, enabled, disabled, moved to another OU or locked out; groups created or deleted; members added or removed; computers joined, removed or disabled. A change shows up at the first read after it happened, so up to 4 hours later (or straight after Sync now).

Changes to a privileged group are marked Privileged. The notification "Privileged group changed in Active Directory" is off unless you turn it on in your notification settings.

The first read of a domain records no changes: it's the starting point. A read that couldn't finish a part (a size limit or an error on the domain controller) never treats what's missing from that part as deleted.

Billing per AD user

Revo counts Active Directory users for billing: enabled accounts, without the built-in Administrator, Guest and krbtgt accounts, minus users in OUs you exclude and users you mark not billable. Set excluded OUs (service accounts usually live in one) under Billing on the Overview, and mark one user from their quick look.

In RevoPSA, a contract line can be Per Active Directory user: its quantity is this count on the day the billing run is made.

Contacts

An enabled user whose email (or UPN) is on one of the customer's verified domains becomes one of the customer's contacts. A contact with the same address that's already there (from Microsoft 365, your PSA or entered by hand) is linked, not duplicated, and stays as its source keeps it. A user who leaves AD stops being monitored; the contact is kept for history.