Security Compliance

Limit scope of Active Directory AD scan to the specific Organizational Units OU in ARM

This article describes how to customize the AD scan scope to only certain OUs in ARM.

First published date

11/5/2019 1:10 PM

Last published date

11/12/2025 10:21 PM

Overview

Using default settings ARM will perform Active Directory (AD) scan across all Organizational Units (OU) of the domain. This behavior can be controlled using the below solution by specifying only selected OU which the scan will be performed against.

Product section

Access Rights Manager

Cause

N/A

Resolution

OPTION 1: 
 
1. Add the below code to pnJob.config.xml (ARM Server) configuration files located in C:\ProgramData\protected-networks.com\8MAN\cfg\
  • If the file is missing it should be created and the content should be like the below:
<?xml version="1.0" encoding="utf-8"?>
<config>
 <activeDirectory>
    <scanOUOnly>
	   <YOUR.DOMAIN.COM type="System.String">OU=ARM-Test;OU=Second-OU,OU=Nested</YOUR.DOMAIN.COM>
    </scanOUOnly>
 </activeDirectory>
</config>
 
2. This is all that should be done, the rest will be handled by ARM, and copies of pnJob.config.xml file will be transferred to the collector and they will be named "pnJob.server.config". Changes should only be made in C:\ProgramData\protected-networks.com\8MAN\cfg\pnJob.config.xml on the ARM server.
3. In the above example:
  • AD domain: YOUR.DOMAIN.COM
  • selected OU(s)
    • OU=ARM-Test
    • OU=Nested > OU=Second-OU
 
OPTION 2: 
  1. Open 'SolarWinds ARM Configuration Wizard.exe' at "C:\Program Files\SolarWinds\ARM\Tools\ConfigWizard.exe."
  2. Turn on Advance Settings.
    • image.png
  3. Select the domain you need to perform the changes and click Edit.
  4. In the 'Advanced' section, select the OU(s) you want to scan or just leave 'Root' to scan all AD.
  5. Save the changes.
Attention: the container "Users" and "Builtin" will always be scanned because they contain important system accounts and groups (eg: Administrator). All accounts outside the defined scope will not be resolved by ARM and only be displayed as SIDs.