Leverage MIIS Statistics and Provide Trend Analysis

1
Leverage MIIS Statistics and Provide Trend
Analysis

• Active Identity Management, Inc.
• Rob Allen
• www.activeidm.com

2
Lifecycle of a typical MIIS Installation

• Requirements Gathering (Interviews of data
  owners, Applications, Core deliverables)
• Design Architecture (Layout of Management
  Agents, Projection Rules, Join Rules,
  Provisioning points, De-Provisioning Points)
• Development Cycles (Rule Extension and MetaVerse
  Extension coding, Management Agent sequences,
  Scenario Testing)

3
Lifecycle of a typical MIIS Installation (continue
d)

• Pre-Production Testing (Simulations of run
  sequences in a mirror environment of production
  data)
• Production Burn-in of Core components (Providing
  run sequences without Exporting data to
  Production Systems)
• Go-Live Delivery of end state documentation

4
The Missing Factor?
Dev Cycles
Design Architecture
Pre-Prod Testing
Text
MIIS LifeCycle
Requirements Gathering
Prod Burn-in
Go-Live
?
Stats Trending
5
The Missing Factor Why would you want to track
and trend MIIS data

• Without tracking and trending changes, your
  organization will never understand the value MIIS
  provides the company
• MIIS statistics justify the implementation time
  and costs
• Trend analysis can justify expanding the MIIS
  environment to meet expected future growth
• Most MIIS implementations GO-LIVE without a
  reporting engine or statistical analysis
  component.

6
What can you track from MIIS?
7
Password Reset Tracking and Trending

• How many password resets does MIIS process?
• How many HelpDesk calls were avoided?

8
Track and report statistics on application log
events related to Password Change Notification
Services

PCNS Events Monitoring PCNS involves the capture
and analysis of event logs. PCNS creates events
in the event log for a variety of tasks that
either complete or fail. Microsoft Operation
Manager Management Pack for PCNS can be used or
you can utilize scripts to parse the event logs
for insertion into a table.
9
Account Creation Tracking and Trending

• How many accounts do you create on a given
  weekday?
• Show management an immediate day-to-day time
  saver

10
Account Tracking Demo
11
Business Changes Tracking and Trending

• What business changes have impacted the number
  of updates to objects in your enterprise?
• Office location changes, organization
  restructuring
• Why do business changes impact AD? Attribute
  data changes.

12
Business Changes Impact Demo
13
Computer Object Tracking

• How many computer objects do you manage?
• Track licensing of software
• Track hardware allocation

14
Computer Tracking Software License Impact Demo
15
How do you Track/Trend MIIS?

• Utilize WMI to connect to the MIIS Server
• Query per Management Agent
• VBSCRIPT
• Set Service GetObject("winmgmtsauthenticationL
  evelPktPrivacy!root\MicrosoftIdentityIntegration
  Server")
• Set ManagementAgent Service.Get("MIIS_Management
  Agent.Name'ADAM_Client_MA'")

16
PowerShell Example (from Oxford Computing
Session) ADMA Get-WmiObject Class
MIIS_ManagementAgent Namespace
root/MicrosoftIdentityIntegrationServer Filter
NameOxford AD
17
Pull RunTimes, Add, Updates, Deletes
VBSCRIPT strRunProfile
"ADAM_Client_MA " ManagementAgent.RunProfil
e() strRunStartTime ManagementAgent.RunStartT
ime() strRunEndTime ManagementAgent.RunEndTim
e() strNumCSObjects ManagementAgent.NumCSObje
cts() strNumImportAdd ManagementAgent.NumImpo
rtAdd() strNumImportUpdates
ManagementAgent.NumImportUpdates()
strNumImportDeletes ManagementAgent.NumImportDe
letes()
18
PowerShell Example (partially extracted from
Oxford Computing Session) mainfo
ForEach-Object Name _.Name StartTime
_.RunStartTime().ReturnValue EndTime
_.RunEndTime().ReturnValue CSObjects
_.NumCSObjects().ReturnValue ImportAdds
_.NumImportAdds().ReturnValue ImportUpdates
_.NumImportUpdates().ReturnValue ImportDelete
_.NumImportDeletes().ReturnValue Connectors
_.NumTotalConnectors().ReturnValue Disconn
ectors _.NumTotalDisconnectors().ReturnValue

19
Write data to a database table
VBSCRIPT (sample code) Set objConnection
CreateObject("ADODB.Connection") Set objRecordset
CreateObject("ADODB.Recordset") objConnection.Op
en "DSNAutomation" objRecordset.CursorLocation
adUseClient objRecordset.Open "Select FROM
MIISMgmt WHERE DateStamp '" strDateStamp
"'", objConnection, adOpenStatic,
adLockOptimistic If objRecordset.EOF Then
objRecordset.AddNew objRecordset("DateStamp)
strDateStamp objRecordset("runProfile")
strRunProfile.
20
Pull additional data from AD/ADAM and integrate
with MIIS data

• VBSCRIPT (sample code)
• Set objConnection CreateObject("ADODB.Connection
  ")
• Set objCommand CreateObject("ADODB.Command")
• objConnection.Provider "ADsDSOObject"
• objConnection.Open "Active Directory Provider"
• Set objCOmmand.ActiveConnection objConnection
• On Error Resume Next
• objCommand.CommandText _
• "Select name, distinguishedName from _
  "'LDAP//serverName389/CNPEOPLE,CNDirectory,DC
  com' " _
• "where objectClass'user' "

21
Utilize MOM PCNS Management Pack or scrape the
event logs with scripts
VBSCRIPT (sample code) strComputer "." Set
objWMIService GetObject("winmgmts" _
"impersonationLevelimpersonate!\\"
strComputer "\root\cimv2") ' Monitored
EventIds ' 2000 COnnectivity
Errors 2000 MA Completed with Errors 2000
Export Changed not Re-imported ' ..
22
VBSCRIPT (sample code cont) Dim
arrMonitorEvents(4) arrMonitorEvents(0)
2000 arrMonitorEvents(1) 2000 arrMonitorEvents(2
) 2000 'Loop through the eventIds in
arrMonitorEvents For i0 to UBOUND(arrMonitorEvent
s) Set colLoggedEvents
objWMIService.ExecQuery _ ("Select from
Win32_NTLogEvent Where Logfile 'Application'
and " _ "EventCode '" arrMonitorEvents(i)
"' and TimeWritten gt ' dtmStartDate
"'") .
23
VBSCRIPT (sample code cont) '
' Build
Strings for Table
For Each objEvent in
colLoggedEvents FoundEvents 1 strCode
objEvent.EventCode strDate
Left(objEvent.TimeWritten, 8) strHour
Mid(objEvent.TimeWritten, 9, 2) strMinute
Mid(objEvent.TimeWritten, 11, 2)
strEventMessage objEvent.Message Next Next

24
Run as a pre or post processing task to your
MASequencer

• Utilizes the MASequencer.exe from the MIIS 2003
  Resource Kit

25
Correlate additional data viewing with SQL
Reporting Services

• SMS
• MOM
• PKI
• Badging System
• Anti-Virus

26
Trend Analysis Results

• PCNS Events
• Account Creations
• Business Changes
• Computer Management

27
QA
28
Discussion/Closing