Document importing Windows hosts from Active Directory
Adds Active Directory Import, and updates the pages that the feature changes.
The new page leads with the part that is not obvious from the requirement: the
preview is persisted server-side and apply may only subtract from it, because a
WindowsTarget row makes DAD connect out to a named host carrying a domain
credential. It also records the three query behaviours that are load-bearing
(paging against AD's silent 1000-object cap, unclassifiable operating systems,
domain controllers), the two-credential model, and what is and is not covered by
CI.
Home: the feature is the most recent pass, and the chronology now reads in order
-- the Windows-source paragraph no longer claims to be "the most recent".
Access Control: new section on why two controllers are Admin-only at the
controller level, where reads are gated, unlike windows_targets. Corrects
hidden? to a class method.
Development: the two remote integrations and the seams they sit behind; suite
counts corrected to 581 + 40 runs / 1969 assertions.
Interface: the connection screens and the two-page import, including which rows
arrive pre-checked and which do not.
Installation: DAD_AR_ENCRYPTION_* and WINDOWS_SSL_VERIFY now name the second
model that reads them; one variable covers the LDAPS and WinRM trust decision
rather than two.
Windows Events: cross-links, and the LDAP gap added to "limits worth knowing".
What Changed Since 2016: new dated section, and the system-suite assertion count
corrected to 247.
Every claim here was checked against the code. Two were wrong as first written
and corrected: the LDAPS/StartTLS note is on the show page, not the index, and
the import result lands on the Windows targets screen.
Co-authored-by: openhands <openhands@all-hands.dev>
Update the wiki for direct WinRM polling of Windows hosts
DAD now polls Windows hosts itself with wevtutil over WinRM instead of
requiring OpenWEC on the Windows side plus a fourth daemon to forward
what it wrote. The OpenWEC path stays documented as the alternative,
because a subscription receives events pushed to it and a pull model
cannot recover records for a host DAD cannot reach.
Windows-Events.md is restructured around the two paths sharing one
pipeline rather than around OpenWEC specifically. New material: the
priority bands and the adaptive interval (clamp(500/eps, band_min,
band_max), EMA-smoothed rate, 25% deadband), per-host disable, the
credential model and why the encryption keys must not be rotated, the
60s delta overlap and the duplicate trade, and the failure behaviour
that keeps one bad host or channel from costing the others.
Also corrected along the way, independent of this feature:
- Access-Control.md never documented ACTION_RIGHTS at all, only
CONTROLLER_RIGHTS. That is the mechanism that makes reading a target a
Viewer action while writing or polling one is Admin, so it is now
spelled out with the reason for each override.
- Interface.md had no Windows targets section, and its paginated-list
count was twelve.
- Jobs.md listed seven handlers; there are eight. Added a note that the
Job frequency is not the polling interval, since the two numbers being
different is easy to misread as a bug.
- Development.md test counts were 488/40 runs, 1679 assertions.
- Installation.md was missing DAD_AR_ENCRYPTION_KEY,
DAD_AR_ENCRYPTION_SALT and WINDOWS_SSL_VERIFY, and had no warning that
rotating the credential keys makes stored credentials unreadable --
unlike SECRET_KEY_BASE, which is safe to rotate.
- Architecture.md and Home.md described Windows collection as OpenWEC
only.
- What-Changed-Since-2016.md gets an entry, since the older pages
describe a design that no longer holds.
Stated as limits rather than glossed over: the WinRM transport is not
exercised in CI (no Windows host; the transport sits behind a seam and
the parsing/delta/queueing logic is tested against recorded wevtutil
XML), and the pull path reads rather than subscribes, so records written
while a host is unreachable are only recovered if they are still in the
channel next poll.
This wiki update was prepared by an AI agent (OpenHands) on behalf of the
repository owner.
Co-authored-by: openhands <openhands@all-hands.dev>
Document Windows event ingest via OpenWEC
Adds [[Windows Events]]: the OpenWEC setup, the four output formats and
their field mapping, the environment variables, and a troubleshooting
table that names which symptom means which broken link.
The two things an operator can get wrong in a way that corrupts data
rather than erroring get their own headings -- do not point OpenWEC at
Logs/LogStaging, and why one record is not one line.
Home: new paragraph and a row in the start table. Architecture: the
unit table gains dad-windows, and the "nothing else should touch Logs/"
line now says *why* -- the collector's startup recovery moves every file
it finds in LogStaging, so a second writer there gets its in-progress
file renamed away mid-append. Installation: OpenWEC as an optional
requirement, the windows compose profile, and the five WINDOWS_*
variables. Development: the docker job's new Windows leg, and suite
counts corrected to 488 runs / 1679 assertions. What Changed Since 2016:
DAD is no longer syslog-only, with the two assumptions that stop holding.
Co-authored-by: openhands <openhands@all-hands.dev>