Helpful Comparisons of Active Directory Reporting Tools

I. Seven Essential Factors to Consider When Evaluating an Active Directory Reporting Tool –

The following is a list of 7 essential factors that must be considered when evaluating the suitability of an Active Directory reporting tool to fulfill your reporting needs, because, together, these 6 factors provide a well-rounded and objective basis that can help you make a well-informed decision –

1. Trustworthiness

   This is one of the most important yet one of the most overlooked aspects of an Active Directory reporting solution.

   It is very important because Active Directory reporting solutions are very often installed on administrative machines and/or used by highly-privileged administrators and thus, in most cases, run in highly powerful administrative contexts. The integrity of (the code of) the reporting solution is thus of utmost importance, because should the code be tamperable or malicious (accidentally or intentionally), it could very quickly inflict substantial damage to organizational security.

   The trustworthiness of a reporting solution depends on many factors, such as who built it, where is it built, the physical, system and network security afforded to the tool's code-base, the degree to which the application's integrity can be protected, the proficiency of the developers of the tool, the expertise upon which its reports are engineered, and so on.

2. Reporting Essentials

   This aspect involves an assessment of the essential reporting capabilities of an Active Directory reporting tool, such as the types of reports it can generate (e.g. security, access), the formats it can generate them in (e.g. CSV, HTML etc.), the ease of use, the ability to customize reports (e.g. custom fields, titles, descriptions etc.), and whether the tool offers real-time reporting or reporting based on data pulled into a database at frequent intervals, and so on.

3. Security Reporting

   This aspect involves an assessment of the security reporting capabilities of an Active Directory reporting tool, assessing the various IT management categories covered by the reporting by the tool (e.g. user account management, security group management, etc.) It also takes into account certain specific high-value reports such as true last-logon reports and nested group membership reports, which many organizations find valuable and consider as important.

4. Access Reporting

   This aspect involves an assessment of the ability of the Active Directory reporting tool to generate true access reports.

   A true access report is one that accurately determines resultant access in Active Directory to reveal who actually has what access in Active Directory. These are also commonly referred to as delegated access reports or effective access reports. Many reporting solutions claim to offer access reports, but in fact these are not true access reports, but merely security permission reports which simply assess and show who has what permissions in Active Directory.

   Who has what permissions in Active Directory is absolutely not the same as who really has what access in Active Directory. This is because the presence of a permission by itself does not determine resultant access, but in fact is just the starting point in making that determination. There are more than one dozen factors that influence who really has what access in Active Directory, and who has what permissions is merely the first factor.

   If a vendor claims that they offer access reports, organizations should seek clarification as to whether these are true access reports, or merely security permission reports, as the difference is vast, and because accuracy is absolutely vital when it comes to security, overlooking this factor could in fact lead you to make false access conclusions that endanger security.

5. Additional Capabilities

   This aspect involves an assessment of any additional capabilities that a reporting tool might offer. For example an Active Directory reporting tool could offer the ability to view Active Directory ACLs to search for Active Directory objects.

   Additional capabilities enhance the tool's value proposition and subsequently its usefulness and value.

6. Deployment Overhead

   This aspect covers another important yet often overlooked aspect of Active Directory reporting tools, and that is the deployment and maintenance overhead and related cost associated with deploying the Active Directory reporting solution.

   For instance, some solutions require that an agent be installed on one or more machines, or a SQL Server be installed, or a network appliance be installed. The installation of an agent, service or server undoubtedly introduces an additional IT resource in your environment, which must also be managed, secured and maintained, resulting in an additional expense.

   In addition, in some cases, licensing needs require that certain changes be made to the Active Directory, such as the use of a Service Connection Point or a Schema extension, or the creation and use of a dedicated domain user account of security group. Any introduction of content to the Active Directory creates an additional management overhead and security concern, as this additional content in Active Directory would also need to be managed, secured and maintained.

   The deployment overhead of a solution is thus an important aspect of the selection criteria and must not be overlooked.

7. Pricing and Licensing

   This aspect covers the basic but essential factors of product licensing and pricing.

   The price of the reporting tool, while important, should never be the most important factor to consider, because in the big picture, given that Active Directory plays such a vital role in your organization, in the long run, a small price difference is almost inconsequential in comparison to the other important factors listed above.

   In fact, the licensing model of the tool deserves more attention because as your business requirements change, so might your licensing needs, and a versatile licensing model should be able to accommodate your changing needs. For instance, should you wish to acquire additional licenses, or transfer your existing licenses, or have a license be usable on multiple machines, your tool's licensing model should be able to easily accommodate reasonable changes in your business needs.

   The old truism you get what you pay for applies almost universally, and Active Directory reporting tools are no exception.

II. A Comparison of Active Directory Reporting Tools –