9

I had been using ADInsight from Sysinternals to trace Active Directory calls from my workstation, but the application has failed.

Where previously the Active Directory events were traced and logged, now the window remains blank, whether the application is in capture mode or not. I have run as Administrator, rebooted, downloaded a new version; none of those actions has returned the program to a functional state.

The Sysinternals forums don't offer much hope, since this tool is known to fail often.

Is there tool that has similar functionality?

Questions

Does the tool fail when run from another workstation with your account? Yes

Does it fail from your (and/or) another workstation using someone else's account? Yes

Is there anything in the event log of your workstation? No

Improve this question
7
  • 2
    How did it fail? Perhaps you should be asking a question about the problem you are having with it.
    – Zoredache
    Apr 24, 2012 at 17:40
  • Troubleshoot this to find out if the problem is your account, your workstation, or AD. Does the tool fail when run from another workstation with your account? Does it fail from your (and/or) another workstation using someone else's account? Is there anything in the event log of your workstation?
    – mfinni
    Apr 24, 2012 at 17:50
  • Hm - OK, if the tool is known buggy (I've never used it myself), and it happens on multiple workstations and accounts, then it's either the tool or your AD. It might help you if you knew what changed in your AD between when Insight worked and when it didn't. I don't have an alternative tool to suggest. What problem are you solving with this tool - are you debugging an AD tool that your company develops?
    – mfinni
    Apr 24, 2012 at 18:39
  • Interestingly, ADInsight doesn't work on my workstation either.
    – mfinni
    Apr 24, 2012 at 18:41
  • 1
    it may be that its a 64 bit application or 64 bit workstation, the tool only works with 32 bit at the moment.
    – user125968
    Jun 26, 2012 at 0:56

3 Answers 3

Reset to default
8

There are known issues with ADInsight and it is no longer supported or developed. It has issues loading its DLL in certain environments, specifically on VMs (see http://forum.sysinternals.com/adinsight-doesnt-work-hangs_topic18891.html and http://forum.sysinternals.com/adinsight-operation_topic18963.html) (archive links)

The best solution I have found is to turn on Active Directory Diagnostic Logging as described at http://www.activedir.org/Articles/tabid/54/articleType/ArticleView/articleId/41/Default.aspx (archive link). Basically, you want to set the following registry values:

Path: HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics\15 Field Engineering
Type: DWORD
Value: 5

Path: HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\Expensive Search Results Threshold
Type: DWORD
Value: 1

These changes do not require a reboot but are set per server, so implementing for an entire forest/domain would best be done via Group Policy Preferences. Once set you will find the resulting logs in the Directory Service event log on the DC. They are not exactly parse-friendly but can be wrangled with some regex. The best part is it requires no external utilities/code.

I would be remiss if I didn't mention that this level of logging may incur a performance penalty on a production DC. In my test environment, with only two DCs doing next to nothing, I see ~10-20 events/minute from just this setting.

Improve this answer
2
2

I know this is an old question but I've just found out that starting from Windows Vista/2008, the windows LDAP client supports ETW.

The reference for the tracing flags is here.

Improve this answer
0
2

ADInsight was updated this year to address these issues.

Source: http://blogs.technet.com/b/sysinternals/archive/2015/10/27/update-autoruns-v13-5-sigcheck-v2-3-rammap-v1-4-bginfo-v4-21-sysmon-v3-11-adinsight-v1-2.aspx

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .