The Active Roles Support Team has a new offering which we hope will help to identify configuration and performance-related issues in customer environments:
https://github.com/OneIdentity/active-roles-assessment-script
This script is safe to run in all environments, as it does not modify anything. It simply builds an HTML report. This is a great place to start if you wish to identify known issues or get a baseline for your configuration.
- Active Roles version and build
- Operating system information
- Managed domains (with optional managed user counts, including a stacked Enabled vs Disabled breakdown per domain)
- Replication partners (Publisher / Subscribers) — Configuration DB and Management History DB
- Dynamic Groups
- Optional broken-rules check
- Distribution across Active Roles servers, with a warning when groups are not evenly balanced
- Top 10 expensive LDAP queries (by
accountNameHistorylength), flagging any group with>= 1000cached entries as Expensive
- Managed Units (with optional broken-rules check)
- Workflows
- Virtual Attributes
- Script Modules and Policy Objects (including orphan policy links)
- Access Templates (including orphan AT links)
- Microsoft Entra (Azure AD) tenants configured in Active Roles
- Microsoft Exchange presence and
PerformanceFlag/Disable500VAregistry checks - SQL Server Auto Shrink status on the AR Configuration database
- SQL Server AlwaysOn / MultiSubnetFailoverSupport check
- SQL Server Parallelism Settings check — Cost Threshold for Parallelism and MaxDOP compared against One Identity recommendations (KB 4383609)
The output is a single self-contained .html file with KPI cards, charts, and searchable/sortable tables. Chart.js is loaded from CDN.