PAGE CONTENTS
- About WebTitan Active Directory Agent (WADA)
- Downloading and Installing WADA
- Installing WADA on Windows Server Core
- WADA Configuration
- Frequently asked questions
About WebTitan Active Directory Agent (WADA)
Web Titan Active Directory Agent (WADA) is responsible for discovering who is logged into what machines on your active directory network using Kerberos authentication events.
WADA must be installed on the Domain Controller or on a machine from which it can communicate with:
Windows Active Directory
DNS Proxy
How WADA Works
Information is gathered from three different sources available on Windows network - LDAP, Event Logger and Network Sessions.
WADA contacts the specified Domain Controller and retrieves a list of Active Directory users and computers from LDAP.
WMI contacts all computers listed in LDAP and checks for active logon sessions.
Note
Only computers with lastLogon field within the range defined in the configuration (1 year by default) are checked.
Windows Security Events are monitored for user logon or logoffs.
Windows network sessions are monitored to detect computers logged onto the network that have not been switched off for long periods of time and which might not be picked up by the other discovery methods.
Downloading and Installing WADA
Follow the steps below to download and install WebTitan Active Directory Agent (WADA).
Click here to download the WADA install file-wada.exe.
Launch an elevated command prompt as described here and run wada.exe with administrator privileges:
Click Windows Start and in the search box type cmd.
Right-click on cmd.exe and choose Run as Administrator:
Click Yes and the Administrator: Command Prompt window displays.
Change directory so you are in the same directory as the wada.exe file downloaded in step 1 and run wada.exe.
The WADA-InstallSheild Wizard window displays. Click Next.
Accept the license agreement and click Next.
Change the install Destination Folder or leave as the default. Click Next.
Click Install.
The 'Does the AD setup use Terminal Servers and Virtual IPs' window displays. Use the table below to complete the fields:
Field
Description
Please provide WebTitan proxyserver hostname or IP:
Enter the hostname or IP assigned to your DNS Proxy during installation.
Port:
Default is 7777 (this is the port when WADA is being installed with DNS Proxy).
If this is only a WebTitan Gateway installation, select WebTitan as the Proxyserver type below and enter 8881 as the port.
Proxyserver type:
Default is DNS Proxy.
Use WebTitan if installing WADA without DNS Proxy. In this case, the Port should be set to 8881 (see above).
Does the AD setup use Terminal Servers and Virtual IPs:
In order for WADA to identify Virtual IP's on your network, it must know which servers are operating as terminal servers. If using terminal servers, select Yes.
Note
Terminal Servers and Virtual IP identification are currently supported only on WebTitan Gateway and not on WebTitan Cloud.
Please provide Terminal Server hostname or IP:
If you select Yes above, enter the hostname or IP address for your terminal server(s).
Multiple hostnames or IPs may be entered. They must be comma separated and not contain any spaces, e.g. server1.abc.local,Server2.abc.local
Does the AD setup use NPS and RADIUS:
Select Yes to tell WADA to listen for RADIUS server Wi-Fi based events. Your Wi-Fi access points need to be enabled with RADIUS accounting and have RADIUS Attribute 8 Framed-IP-Address capability.
Please provide the RADIUS hostname or IP:
Enter the hostname or IP address for your RADIUS server.
Multiple hostnames or IPs may be entered. They must be comma separated and not contain any spaces, e.g. server1.abc.local,Server2.abc.local
Does this WADA installation need to use Security Events:
Select Yes to allow WADA to access the log that contains records of login/logout activity. It is recommended to select Yes.
Select No only if WADA is being installed on a RADIUS server or a terminal server and it is already installed on the authenticating domain controller.
Click Save configuration and continue.
You will be prompted to enter a User name and Password for Web Titan AD Agent. Add the credentials of a domain user the WADA service will run under.
Note
The credentials used must be those of a Domain Administrator.
Click OK. WADA will complete the installation.
Click Finish.
Installing WADA on Windows Server Core
To install WADA on the Window server core, open a command line prompt on the server core OS and enter the following:
powershell Import-Module bitstransfer start-bitstransfer -source http://download.webtitancloud.com/wada/wada.exe -destination c:\wada.exe Add-WindowsFeature –name NET-Framework-Core cd c wada.exe
WADA Configuration
WADA does not require any specific configuration after installation, but changes can be made to the configuration if required. Follow the steps below to make changes.
Run Notepad with elevated privileges (run as administrator) as described here:
Click Windows Start and in the search box type notepad.
Right-click on Notepad and choose Run as Administrator.
Click Yes and Notepad will open (running with administrator privileges).
The WADA configuration file is wada.ini and can be located at
C:\ProgramData\WebtitanADAgent\wada.ini. To make changes, locate wada.ini and open with Notepad running with elevated privileges as described above.wada.ini looks similar to the example shown here. Use the table below to edit parameters as required.
Important
Line breaks in wada.ini must be the same as shown in this example, where each parameter has its own line entry.
[WADA] Proxytype=1 WebTitanServers=http://1.2.3.4:8881 DC=WINSERVER1 LogMinLevel=0 DiscoveryThreads=10 DiscoveryIntMin=30 LastLogonDays=365 TTLMin=60 EnumSessIntS=10 WMICheckIntS=60 WMIMaxCheckRetry=10 Security-Status=1 SwitchUser-Status=1 ExcludedComputers=NETBIOS-NAME,10.1.0.2 ExcludedUsers=[user1.upn],[user-2.upn] [Terminal Servers] TSVR-Status=1 TSVR=Server1.abc.local,Server2.abc.local,Server3.abc.local [RADIUS] RADIUS-Status=1
Close wada.ini and click Save to save your changes.
Parameter | Default | Description |
|---|---|---|
Proxytype | (0) | (0) is for DNSProxy installations (1) is for WebTitan. |
WebTitanServers | IP and port number for your DNS Proxy. This parameter is used to send IP/Username mappings to DNS Proxy. Multiple servers can be specified with a comma (,). For example, if you have two DNS Proxies at 192.0.2.0 and 198.51.100.0, this parameter would be as follows: WebTitanServers=http://192.0.2.0:7777,http://198.51.100.0:8881:7777 | |
DC | Name of the remote domain controller. Can be used to run WADA on a different computer on the network than the Domain Controller. | |
DiscoveryThreads | (10) | Number of child threads used in the WMI discovery process Each thread connects to a computer using WMI and it is done in parallel to speed up the initial discovery process. |
DiscoveryIntMin | (30) | Number of minutes between discoveries (LDAP queries that read the list of available computers and then WMI checks). |
LastLogonDays | (365) | Max. number of days of the last logon to a machine so it is checked against existing sessions with WMI. Based on lastLogon LDAP attribute. Computers with a higher number of 'idle' days will be omitted. |
TTLMin | (60) | Number of minutes after which an IP/user pair is removed from the map if the active login session wasn't found on a given IP during this period (either using WMI checks, events from Event Logger or Network session’s enumerator). |
EnumSessIntS | (10) | Number of seconds between enumerating Network Sessions. Note that Windows XP sessions are showing only for about 15 seconds, so don't change this setting to a higher value or you may lose some information about active logon sessions. |
WMICheckIntS | (60) | Number of seconds between single WMI check on a specific computer. This is to avoid flooding of Windows computers. |
WMIMaxCheckRetry | (10) | Number of retries when a WMI query to a specific computer is failing. If after this number of retries it is still failing, an error is logged to a file waderror.log and the computer is not checked for active sessions with WMI unless there is some activity from other sources (Event Logger or Network Sessions). |
Security-Status | (1) | An On (1) or Off (0) flag that tells WADA to listen for security-based events. |
SwitchUser-Status | (1) | An On (1) or Off (0) flag that tells WADA to ignore session enumeration after the first enumeration for machines perceived to be Shared Computers. |
ExcludedComputers | NETBIOS Name followed by the IP of a machine that is to be excluded from discovery and scanning by WADA. This feature is used to exclude exchange servers from the scan as these machines can result in possible excessive use of WMI on same. | |
ExcludedUsers | The UPN of a user to be excluded from reporting. The UPN is the user's domain logon e.g. user@example.local. This feature is used to exclude application based users e.g. sophos@abc.local | |
TSVR-Status | (0) | An On (1) or Off (0) flag that tells WADA to listen for terminal server-based events. This is used when Virtual IP's are used. |
TSVR | FQDN names of terminal server computers that are issuing visualized IPs to users on the domain. Each terminal server is delimited by a comma. A listener is established for each server listed and virtual IP assignment is captured from the event logger on each one. | |
RADIUS-Status | (0) | An On (1) or Off (0) flag that tells WADA to listen for RADIUS server Wi-Fi based events. Wi-Fi access points need to be enabled with RADIUS accounting and have RADIUS Attribute 8 Framed-IP-Address capability. |
Frequently asked questions
How do I know what version of WADA I am running?
Follow the steps below to determine what version of WADA you are running.
Start the Task Manager.
Click the Details tab and find WADAsvc.exe.
Right mouse click and choose Properties.
Click the Details tab to see the version of WADA currently installed:
Why are some of my Groups not showing in WebTitan Cloud?
WebTitan Cloud only imports groups that contain users. Therefore, if your Active Directory has a group with no associated users, it will not be imported.
Why can I not run a Virtual Machine?
Virtualisation extensions are sometimes disabled in BIOS by hardware manufacturers. If you experience issues running a virtual machine, check that virtualization is enabled on your computer.
Check your computer manufacturer help for recommended method to edit your BIOS settings.