Home
  •  

AD DC Performance Collection - Metric NTDS NTLM Authentications

Microsoft.Windows.Server.2012.R2.AD.DomainController.NTLMAuthentications.Collection (Rule)

Knowledge Base article:

Summary

This rule collects the number of NTLM authentications per second serviced by a domain controller.

This performance collection can help determine if there is an issue with load on a domain controller.

TechNet guide on NTLM Authentications

Element properties:

TargetMicrosoft.Windows.Server.2012.R2.AD.DomainControllerRole
CategoryPerformanceCollection
EnabledTrue
Instance NameSecurity System-Wide Statistics
Counter NameNTLM Authentications
Frequency900
Alert GenerateFalse
RemotableFalse

Member Modules:

ID Module Type TypeId RunAs 
PerformanceDS DataSource System.Performance.OptimizedDataProvider Default
WriteToDB WriteAction Microsoft.SystemCenter.CollectPerformanceData Default
WriteToDW WriteAction Microsoft.SystemCenter.DataWarehouse.PublishPerformanceData Default

Source Code:

<Rule ID="Microsoft.Windows.Server.2012.R2.AD.DomainController.NTLMAuthentications.Collection" Enabled="true" Target="AD2012R2Core!Microsoft.Windows.Server.2012.R2.AD.DomainControllerRole" ConfirmDelivery="false" Remotable="false" Priority="Normal" DiscardLevel="100">

  <Category>PerformanceCollection</Category>

  <DataSources>

    <DataSource ID="PerformanceDS" TypeID="SystemPerf!System.Performance.OptimizedDataProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <CounterName>NTLM Authentications</CounterName>

      <ObjectName>Security System-Wide Statistics</ObjectName>

      <InstanceName/>

      <AllInstances>false</AllInstances>

      <Frequency>900</Frequency>

      <Tolerance>5</Tolerance>

      <ToleranceType>Percentage</ToleranceType>

      <MaximumSampleSeparation>4</MaximumSampleSeparation>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectPerformanceData"/>

    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishPerformanceData"/>

  </WriteActions>

</Rule>