Active Directory Computer Reports
ADManager Plus' Computer Reports offer comprehensive visibility into Active Directory (AD) computer attributes, account statuses, and their BitLocker activities.
In this document, you will learn how to do the following:
- Generate reports from multiple domains.
- Apply filters for targeted results.
- Refine results to include or exclude specific attributes.
- View BitLocker details.
To generate these reports in ADManager Plus, navigate to Reports > Computer Reports > General Reports.
The following reports are available in this category:
- All Computers
- OS Based Report
- Workstation Computers
- Domain Controllers
- Recently Created Computers
- Computers Trusted for Delegation
- Recently Modified Computers
- Recently Deleted Computers
- Managed Computers
- Unmanaged Computers
- Computers with Duplicate Attributes
All Computers
This report provides a list of all computer objects in the selected domain(s). It includes key attributes such as computer name and operating system of the device.
How it works
To generate the All Computers report, ADManager Plus queries the LDAP server for all users with the attribute objectClass set to computer (i.e., objectClass=computer).
How to generate the report
- Select the domain from the Select Domain drop-down. You can select a specific OU in each domain to view the users in it.
- Click Generate.
OS Based Report
This report provides details of computers filtered by the selected operating system (OS) versions. It helps administrators analyze OS distribution, track system versions, and support upgrade planning and compliance monitoring.
How it works
To generate the OS Based Report, ADManager Plus uses the LDAP query (&(objectCategory=computer)(objectClass=computer)(operatingSystem=<input_value>)(operatingSystemServicePack=<input_value>*)).
How to generate the report
- Select the domain from the Select Domain drop-down. You can select a specific OU in each domain to view the users in it.
- Under Select OS, select the OS versions for which you intend to generate a report. You can filter options to select Servers and Workstations using the Filter By field.
- Click Generate.
Workstation Computers
This report provides comprehensive details of workstation computers within the selected domain. The report is auto-generated every day at 6am.
How it works
To generate the Workstation Computers report, ADManager Plus queries the LDAP server for the attribute userAccountControl and checks if the ADS_UF_WORKSTATION_TRUST_ACCOUNT flag is set.
How to generate the report
- Select the domain from the Select Domain drop-down. You can select a specific OU in each domain to view the users in it.
- Click Generate.
Note All computers except domain controllers are categorized as workstations.
Domain Controllers
This report provides detailed information about domain controllers within the selected domain. It includes key attributes such as operating system, DNS name, and domain name. It helps administrators monitor the availability of domain controllers. The report is automatically generated every day at 6am to ensure up-to-date visibility.
How it works
The report identifies computer objects assigned the domain controller role and retrieves their relevant attributes from Active Directory. ADManager Plus queries the LDAP server for the attribute userAccountControl and checks if the ADS_UF_SERVER_TRUST_ACCOUNT flag is set. The report is automatically refreshed on a daily schedule and can also be generated on demand.
How to generate the report
- Select the domain from the Select Domain drop-down. You can select a specific OU in each domain to view the users in it.
- Click Generate.
Recently Created Computers
This report provides details of computer objects that were created recently in the domain based on the selected time period. This helps administrators track newly added devices, monitor provisioning activities, and ensure compliance with organizational standards.
How it works:
The report queries Active Directory to identify computer objects based on their creation date using the LDAP query (&(objectCategory=computer)(objectClass=computer)(createTimeStamp>=20080815042538.0Z)). Administrators can specify a time range to filter results, view detailed attributes of each newly created computer account, and export the data.
How to generate the report
- Select the domain from the Select Domain drop-down. You can select a specific OU in each domain to view the users in it.
- Select the desired period from the options provided or enter a custom range under the Select the desired time period field.
- Click Generate.
Computers Trusted for Delegation
This report provides details of computers that are trusted for delegation in the selected domain, helping administrators assess potential security risks and identify systems that can impersonate user credentials to access network services.
How it works
The report queries Active Directory to identify computer objects configured with the userAccountControl attribute and checks if the ADS_UF_TRUSTED_FOR_DELEGATION flag is set.
How to generate the report
- Select the domain from the Select Domain drop-down. You can select a specific OU in each domain to view the users in it.
- Click Generate.
Recently Modified Computers
This report provides details of computer objects that were modified recently in the selected domain. It helps administrators audit updates and monitor administrative activities.
How it works
To generate the Recently Modified Computers report, ADManager Plus scans the selected domain(s) to identify computer objects whose attributes were updated within the selected time period. It retrieves the relevant modification timestamps and computer details by checking the value for the attribute ModifyTimeStamp.
How to generate the report
- Select the domain from the Select Domain drop-down. You can select a specific OU in each domain to view the users in it.
- Select the desired period from the options provided or enter a custom range under Select the desired time period.
- Click Generate.
Recently Deleted Computers
This report displays the list of computer objects that were deleted recently from the domain, along with relevant details such as deletion time and the account that performed the deletion. It helps administrators track deletion activities, investigate incidents, and support recovery and compliance requirements.
How it works
To generate the Recently Deleted Computers report, ADManager Plus queries Active Directory for deleted computer objects within the user-specified time period. It extracts the relevant attributes from the deleted objects container using the LDAP query (&(isDeleted=TRUE)(whenChanged>=20080815042700.0Z)).
How to generate the report
- Select the domain from the Select Domain drop-down. You can select a specific OU in each domain to view the users in it.
- Select the desired period from the options provided or enter a custom range under the Select the desired time period field.
- Click Generate.
Managed Computers
This report provides a list of computer objects that are currently managed within the domain. Key attributes such as computer name, operating system, and who it is managed by can be viewed. It helps administrators monitor device inventory and ensure effective endpoint management.
How it works
To generate the Managed Computers report, ADManager Plus queries Active Directory to identify all computer objects that are managed using the LDAP query (&(objectcategory=computer)(managedBy=*)).
How to generate the report
- Select the domain from the Select Domain drop-down. You can select a specific OU in each domain to view the users in it.
- Click Generate.
Unmanaged Computers
This report provides a list of computer objects in the domain that do not have an assigned manager. The key attributes of the report include the computer name, manager name, and the operating system of the device. It helps administrators identify unmanaged devices and assess potential security risks.
How it works
To generate the Unmanaged Computers report, ADManager Plus queries Active Directory to identify computer objects that are not managed using the LDAP query (&(objectcategory=computer)(!managedBy=*)).
How to generate the report
- Select the domain from the Select Domain drop-down. You can select a specific OU in each domain to view the users in it.
- Click Generate.
Computers with Duplicate Attributes
This report provides details of computer objects that contain duplicate values for a selected attribute. It helps administrators identify inconsistencies and maintain data accuracy within the domain.
How it works
To generate this report, select the required domain and the attribute for which duplicate values need to be identified. ADManager Plus scans the selected domain, detects all computers using the LDAP query (&(objectcategory=computer)(objectClass=computer)), then processes the result based on the selected attribute on the server side.
How to generate the report
- Select the domain from the Select Domain drop-down. You can select a specific OU in each domain to view the users in it.
- Select the attribute that needs to be compared from the Select Attribute drop-down.
- Click Generate.
Note Generated results can be filtered to display the memberOf attributes of computers.
Active Computers
This report provides the details of the computers through which users have logged on to the domain, during the specified time frame.
To view/generate this report,
- Click Reports Tab.
- In 'Computer Reports', select the Active Computers report from the reports available under account status reports
- Select the required domains, specify the desired time period using the options provided (today, yesterday, on a specific date, before a specific date, after a specific date, last N days, this week, this month, any custom period, etc.), and click the Generate button.
Inactive Computers
Provides the details of the computers inactive for the number of days specified. Inactive computers are determined either based on their "Last Logon" time (lastLogon attribute) or the "Password Last Set" time (pwdLastSet attribute). The report is based on the selection made by clicking on the "More Options" link.
If the "Last Logon Time" option is selected: All the configured Domain Controllers (DCs) are scanned for their last logon times and computers that were not logged into for the selected period are considered to be inactive and listed. The "Last Logon time" is not replicated across DCs, and hence if any of the DCs could not be contacted while report generation, the reported data might be incomplete.
If the "Password Last Set" time is selected to determine inactive computers: The First Domain Controller (PDC) provided in the Domain Settings is scanned for the last time a computer's password was set and added to the list if greater than specified number of days.
This report is also auto-generated everyday at 6.00 AM to update the dashboard.
To view the details for a different period, specify the desired time period using the options provided (today, before a specific date, last N days, this week, this month, any custom period, last 30/60/90 days, etc.), and click Generate.
Enabled Computers
Provides the details of the computer objects that are enabled in the selected domain. Enabled computer accounts have working connection with the domain and are able to authenticate to the domain. This report is auto-generated everyday at 6.00 AM.
To generate this report, go to AD Reports tab, click the Computer Reports link on the left pane. Under Account Status Reports, click the Enabled Computers report. Select the required domains and OUs and click the Generate button.
Disabled Computers
Provides the details of the computer objects that are disabled in the domain. Disabling computer account breaks that computer's connection with the domain and that computer will not be able to authenticate to the domain. This report is auto-generated everyday at 6.00 AM.
To generate this report, go to AD Reports tab, click the Computer Reports link on the left pane. Under Account Status Reports, click the Disabled Computers report. Select the required domains and OUs and click the Generate button.
BitLocker Recovery Keys
This report retrieves the volume GUID, recovery GUID, recovery password and also the KeyPackage (in a downloadable format), of all the BitLocker protected/encrypted drives of your computers. These details help you unlock and also recover the data from the demaged/corrupted BitLocker protected drives, using the BitLocker Recovery Tool (Recover-bde).
BitLocker Recovery Keys report fetches all these details from the 'msFVE-RecoveryInformation' objects in your Active Directory. It uses the LDAP query 'objectCategory=msFVE-RecoveryInformation' for this purpose.
To generate this report, go to AD Reports tab, click the Computer Reports link on the left pane. Under General Reports, click the BitLocker Recovery Keys Report. Select the required domains and the corresponding OUs and click the Generate button.
Note This report will fetch these data only if you have
- Configured BitLocker encryption/protection for your computers drives
- Backed up the BitLocker recovery information in the Active Directory
BitLocker recovery information can be saved in Active Directory only if you are running on Windows Server 2003 SP1 or later (Windows Server 2003 SP2, Windows Server 2003 R2, Windows Server 2008, Windows Server 2008 R2). In case of Windows 2003 SP1/SP2, it is mandatory to apply the schema extension to store the BitLocker recovery information.
BitLocker Enabled Computers
This report fetches the list of all BitLocker enabled computers in your domain. Further, this report has the capability to list the BitLocker enabled computers from multiple domains.
To generate this report, go to AD Reports tab, click the Computer Reports link on the left pane. Under General Reports, click the BitLocker Enabled Computers report. Select the domains and their corresponding OUs, for which you wish to view this report, and click the Generate button.
BitLocker Disabled Computers
This report fetches the list of all computers that do not have BitLocker keys, in your domain. Further, this report has the capability to list the computers that donot have BitLocker keys from multiple domains, as well.
To generate this report, go to the Reports tab, click on the Computer Reports link on the left pane. Under BitLocker Reports, select the BitLocker Disabled Computers report. Select the domains and their corresponding OUs, for which you wish to view this report, and click on the Generate button.