Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have various services configured to authenticate against Active Directory. It would be very helpful if they all logged authentication failures, but they don't. This makes debugging even a simple "incorrect password" error very frustrating.

Is it possible to watch in realtime (or later) authentication attempts against AD?

The AD is Windows Server 2003.

share|improve this question
From where? A linux workstation or a Windows PC? Have you checked out wireshark? – wolfgangsz Aug 18 '10 at 17:05
"From Where" is irrelevant, but in this example, I'm using a web-based bug tracking program. Wireshark won't help because the requests are encrypted with Kerberos. I need logging. – Matt Simmons Aug 18 '10 at 17:08
Are these services/apps authenticating against your DC(s) or another source? – jscott Aug 18 '10 at 17:19
They are against my domain controllers (is there another way?) – Matt Simmons Aug 18 '10 at 17:24
In the lovely K12-software-world we have software that "does AD" by taking a night export from csvde. – jscott Aug 18 '10 at 18:04

I'm going to go with the get-eventlog cmdlet in PowerShell. This just dumps the latest entry in the application log:

Get-EventLog -ComputerName foo -LogName application -Newest 1

It just needs tweaking to limit it to authentication events and sources (-source), and to run it against a list of servers. Maybe schedule it to dump in daily or hourly increments (-after [time])? I'm clearly no scripting genius but it's what I've got. ;)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.