Hi,
I have a powershell script that gathers all of the trusted domains in our environment and then sends each domain name to another script to time the amount of time it takes to receive a response to an unqualified (isolated) name query in AD.
Script 1 code:
#Load the Active Directory Module
Import-module activedirectory
#Search the local schema for all trusted domain objects
$ADDomainTrust = Get-ADObject -Filter {ObjectClass -eq "trustedDomain"} -Properties * | Sort-Object cn
#Define workflow to pass domain names to trustsearch script
workflow Get-domains
{
param( $trusteddomainlist)
foreach -parallel ($trusteddomain in $trusteddomainlist)
{
$trust = $trusteddomain.name
InlineScript {C:\trustsearch.ps1 $using:trust}
}
}
Get-domains -trusteddomainlist $ADDomainTrust
As you can see, I'm using a "foreach -parallel" workflow to query each trusted domain simultaneously. This is done to alert us to a potential problem as quickly as possible, without having to wait for the entire script to finish.
Here's the code for the second (isolated name query) script. It sends me an e-mail if the query takes over 60 seconds.
Script #2 code:
$trust=$args[0]
foreach($domain in $trust){
$startDTM = (get-date)
$objUser = New-Object System.Security.Principal.NTAccount("junk")
$strSID = $objUser.Translate([System.Security.Principal.SecurityIdentifier])
$strSID.Value
$endDTM = (get-date)
$totaltime = (($endDTM-$startDTM).TotalSeconds)
$ftotaltime = "{0:N2}" -f $totaltime
Function SendMail
{
#SMTP server name
$smtpServer = "<SMTP server IP address>"
#Creating a Mail object
$msg = new-object Net.Mail.MailMessage
#Creating SMTP server object
$smtp = new-object Net.Mail.SmtpClient($smtpServer)
#Email structure
$msg.From = "<sender e-mail address>"
$msg.ReplyTo = "<reply e-mail address>"
$msg.To.Add("<recipient e-mail address>"
$msg.subject = "Isolated Name monitor warning"
$msg.body = @"
Isolated name queries are running slowly. A script measures how long the NAMCK domain controllers take to resolve an unqualified name query. It usually takes no more than 60 seconds to execute. It is currently taking $ftotaltime seconds.
This may indicate a trust issue or a problem with a downstream trusted domain.
"@
#Sending email
$smtp.Send($msg)
}
If ($ftotaltime -gt "60.00")
{
SendMail
}
Unfortunately, I'm getting a lot of false positives....e-mail alerts when query responses are taking only 7 or 8 seconds, not just over 60. It seems to happen most during the first 2 or 3 minutes the script runs. I think it has something to do with it running
in parallel, because when I remove the "foreach -parallel" functionality, I don't get any false positives.
Does anyone have suggestions on how to cut down or even eliminate the false positives without removing the "foreach -parallel" functionality?
Thanks.