Active Directory Performance Metrics (DataDog#20894)

* First Poc draft of netlogon metrics

* Perfmon metrics added

* Added new readme, metadata, and corrected linting issues

* Partially working tester

* Harden and optimize check with thread safety, cache updates and updated read me

* Removed code duplication between Active Directory and Windows Service integrations

* Revert changes to datadog_checks_base files from c0edd4c

* New readme and ddev validate

* validated models

* windows py updates

* Validation changes to AD folder

* Enumerated windows services in windows.py

* Initial cleanup

* Clean up logic

* Fix tests

* Clean up metrics + remove changelogs

* Override check method + don't raise exception

* Fix lint errors

* Fix metadata

* Just check if service exists

* Update readme

* Update conftest comment

* Fix changelog

* Remove mock instances

* Clean up unit tests

* Add periods to DHCP counters

---------

Co-authored-by: briantu <brian.tu@datadoghq.com>

Author: davidioin

active_directory/README.md

@@ -32,6 +32,37 @@ If installing the Datadog Agent on a domain environment, see [the installation r
 
 See [metadata.csv][8] for a list of metrics provided by this integration.
 
+The integration collects metrics from the following Windows performance objects:
+
+- **NTDS**: Core Active Directory metrics including replication, LDAP operations, and directory service threads
+- **Netlogon**: Authentication performance metrics including semaphore statistics for monitoring authentication bottlenecks
+- **Security System-Wide Statistics**: Authentication protocol usage metrics (NTLM vs Kerberos)
+- **DHCP Server**: DHCP failover and binding update metrics (when DHCP Server role is installed)
+- **DFS Replicated Folders**: DFS replication health, conflicts, and staging metrics (when DFSR role is installed)
+  - Note: Metrics are tagged with `instance` containing the DFS replication group name
+
+#### Netlogon Metrics
+
+The Netlogon metrics help monitor authentication performance and identify bottlenecks in domain controller authentication processing:
+
+- `active_directory.netlogon.semaphore_waiters`: Number of threads waiting for the authentication semaphore
+- `active_directory.netlogon.semaphore_holders`: Number of threads currently holding the semaphore
+- `active_directory.netlogon.semaphore_acquires`: Total number of semaphore acquisitions
+- `active_directory.netlogon.semaphore_timeouts`: Number of timeouts waiting for the semaphore
+- `active_directory.netlogon.semaphore_hold_time`: Average time (in seconds) the semaphore is held
+
+These metrics are particularly useful for monitoring authentication load from network access control (NAC) devices, Wi-Fi authentication, and other authentication-heavy scenarios.
+
+##### Use Cases
+
+The Netlogon and Security metrics help address several monitoring scenarios:
+
+- **Monitor authentication bottlenecks**: Identify when authentication requests are queuing up, particularly from Cisco ISE NAC devices or high-volume Wi-Fi authentication
+- **Track authentication processing times**: Use `semaphore_hold_time` to determine if authentication is taking too long
+- **Identify MaxConcurrentApi tuning needs**: High `semaphore_waiters` values indicate the need to adjust the MaxConcurrentApi registry setting
+- **Monitor authentication protocol usage**: Track the ratio of NTLM vs Kerberos authentications to ensure proper protocol usage
+- **Detect authentication timeouts and failures**: Rising `semaphore_timeouts` indicate authentication infrastructure issues
+
 ### Events
 
 The Active Directory check does not include any events.

active_directory/changelog.d/20894.added

@@ -0,0 +1 @@
+Add Netlogon, Security, DHCP Server, DFSR metrics and expand NTDS metrics.

active_directory/datadog_checks/__init__.py

@@ -0,0 +1,5 @@
+# (C) Datadog, Inc. 2025-present
+# All rights reserved
+# Licensed under a 3-clause BSD style license (see LICENSE)
+
+__path__ = __import__('pkgutil').extend_path(__path__, __name__)

active_directory/datadog_checks/active_directory/check.py

@@ -1,13 +1,44 @@
 # (C) Datadog, Inc. 2021-present
 # All rights reserved
 # Licensed under a 3-clause BSD style license (see LICENSE)
+
+
+import win32serviceutil
+
 from datadog_checks.base.checks.windows.perf_counters.base import PerfCountersBaseCheckWithLegacySupport
 
 from .metrics import METRICS_CONFIG
 
+SERVICE_METRIC_MAP = {
+    'NTDS': ['NTDS'],
+    'Netlogon': ['Netlogon', 'Security System-Wide Statistics'],
+    'DHCPServer': ['DHCP Server'],
+    'DFSR': ['DFS Replicated Folders'],
+}
+
+
+def _service_exists(service_name):
+    try:
+        win32serviceutil.QueryServiceStatus(service_name)
+    except Exception:
+        return False
+    return True
+
+
+def _get_existing_services():
+    return {service for service in SERVICE_METRIC_MAP.keys() if _service_exists(service)}
+
 
 class ActiveDirectoryCheckV2(PerfCountersBaseCheckWithLegacySupport):
     __NAMESPACE__ = 'active_directory'
 
     def get_default_config(self):
-        return {'metrics': METRICS_CONFIG}
+        """Build metrics configuration based on service availability."""
+        filtered_metrics_config = {}
+        existing_services = _get_existing_services()
+
+        for service in existing_services:
+            for metric in SERVICE_METRIC_MAP[service]:
+                filtered_metrics_config[metric] = METRICS_CONFIG[metric]
+
+        return {'metrics': filtered_metrics_config}

active_directory/datadog_checks/active_directory/metrics.py

@@ -50,6 +50,52 @@
                 'LDAP Bind Time': {'metric_name': 'ldap.bind_time'},
                 'LDAP Successful Binds/sec': {'metric_name': 'ldap.successful_binds_persec'},
                 'LDAP Searches/sec': {'metric_name': 'ldap.searches_persec'},
+                'LDAP Writes/sec': {'metric_name': 'ldap.writes_persec', 'type': 'rate'},
+                'LDAP Active Threads': {'metric_name': 'ldap.active_threads'},
+                'DS Client Binds/sec': {'metric_name': 'ds.client_binds_persec', 'type': 'rate'},
+            }
+        ],
+    },
+    'Netlogon': {
+        'name': 'netlogon',
+        'counters': [
+            {
+                'Semaphore Waiters': 'semaphore_waiters',
+                'Semaphore Holders': 'semaphore_holders',
+                'Semaphore Acquires': {'name': 'semaphore_acquires', 'type': 'count'},
+                'Semaphore Timeouts': {'name': 'semaphore_timeouts', 'type': 'count'},
+                'Average Semaphore Hold Time': 'semaphore_hold_time',
+            }
+        ],
+    },
+    'Security System-Wide Statistics': {
+        'name': 'security',
+        'counters': [
+            {
+                'NTLM Authentications': {'name': 'ntlm_authentications', 'type': 'rate'},
+                'Kerberos Authentications': {'name': 'kerberos_authentications', 'type': 'rate'},
+            }
+        ],
+    },
+    'DHCP Server': {
+        'name': 'dhcp',
+        'counters': [
+            {
+                'Failover: BndUpd Dropped.': {'name': 'failover.binding_updates_dropped', 'type': 'count'},
+                'Failover: BndUpd pending in outbound queue.': 'failover.binding_updates_pending',
+                'Failover: BndUpd received/sec.': {'name': 'failover.binding_updates_received', 'type': 'rate'},
+                'Failover: BndUpd sent/sec.': {'name': 'failover.binding_updates_sent', 'type': 'rate'},
+            }
+        ],
+    },
+    'DFS Replicated Folders': {
+        'name': 'dfsr',
+        'counters': [
+            {
+                'Conflict Space In Use': {'name': 'conflict_space_in_use', 'unit': 'byte'},
+                'Deleted Space In Use': {'name': 'deleted_space_in_use', 'unit': 'byte'},
+                'File Installs Retried': {'name': 'file_installs_retried', 'type': 'count'},
+                'Staging Space In Use': {'name': 'staging_space_in_use', 'unit': 'byte'},
             }
         ],
     },