Skip to main content

LDAP

🗂️ 5. LDAP / Active Directory Required Configuration​

🎯 Purpose​

Enable interaction between the agent and Active Directory (or any LDAP server) to discover users and machines in the domain.

Simplify the setup

Save time by using our automatic installation script with a single command.

Download the script here

Usage steps:​

  1. Download the installation script.

  2. Edit the environment variables in the file to fit your network.

  3. Make the script executable depending on your system:

    • Linux

      chmod +x watchman-ldap-configuration.sh

    • Windows

      Set-ExecutionPolicy RemoteSigned -Scope CurrentUser

  4. Run the script on each target machine in the network.

  5. Done! 🎉

🌐 1. Network access to the LDAP/AD server​

  • Ensure the LDAP or Active Directory server is reachable on the network from the machine running the Watchman agent.
  • Verify network permissions (firewall, VPN, possible proxy).

🔓 2. Open ports​

🧱 On Linux:​

# For LDAP (unencrypted)
sudo ufw allow 389/tcp

# For LDAPS (secure LDAP)
sudo ufw allow 636/tcp

🪟 On Windows:​

  • Open Windows Defender Firewall with Advanced Security

  • Create inbound rules for:

    • TCP 389 (LDAP)
    • TCP 636 (LDAPS)

🔐 It is recommended to use LDAPS (port 636) for better security.

📛 3. DNS configuration​

  • Clients (Watchman agent) must be able to resolve the LDAP/AD server hostname.
  • Check that the domain DNS zone is properly configured in the local network.
  • Test resolution with:
nslookup <ldap_server_name>

🔐 4. LDAP Authentication and Settings​

When configuring in the agent’s Active Directory tab:

  • LDAP URL (e.g., ldap://ad.example.com or ldaps://ad.example.com)

  • Port: 389 (LDAP) or 636 (LDAPS)

  • Base DN (example: DC=example,DC=com)

  • Domain (e.g., example.local)

  • Credentials:

    • Username (e.g., admin@example.local or CN=admin,CN=Users,DC=example,DC=com)
    • Password of the authorized account

👥 The account used must have read permissions on user and computer objects in the domain.

✅ Once configured, you can use the "Add User" and "Add Machine" options in the agent’s Active Directory tab to perform automatic imports.