Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am looking for a method to log ldap access of a Active Directory domain controller. I want to be able to log the username and source IP address access to both 389, and 636(encrypted).

A simple packet capture would get me the source IP, but getting the username will not be possible over ldaps so I am hoping there is some built-in auditing/debug/logging feature in Windows that will give me this information.

share|improve this question
    
I know you can enable diagnostic logging, but I don't think it's what your looking for: support.microsoft.com/default.aspx?scid=kb;en-us;314980 –  Chris S Oct 20 '10 at 19:30

1 Answer 1

up vote 4 down vote accepted

The windows Security event-log does track this, but it isn't easy to extract out of the firehose. The key markers of an LDAP login:

  • EventID: 4624
  • SubjectUserSID: S-1-5-18

The details will be lurking in these XML elements:

  • TargetUserName
  • IPAddress

If you're viewing things in the decoded text-view, the key markers are:

  • EventID: 4624
  • Network Information -> Workstation Name = name of the LDAP Server

The details will be:

  • Network Information -> Source Network Address
  • New Logon -> Account Name

The key thing that differentiates these login events from regular login events is that the ldap binds are in effect logging in TO the domain-controller in question. That's why the "Workstation Name" field is filled in.

Phrasing the search to get these events will prove tricky.

share|improve this answer
    
This is all very helpful, but apparently this is logged differently between 2003, and 2008. I don't suppose you know what I should be looking for in the 2003 events to identify LDAP access? –  Zoredache Oct 22 '10 at 22:34
    
@zoredache I don't have any 2003 DCs anymore, so I can't check. I'm sorry. –  sysadmin1138 Oct 22 '10 at 22:57
    
Ah, I am working on killing off my last two, which is partly why I was curious what things are speaking LDAP to these DCs. –  Zoredache Oct 22 '10 at 23:31
    
In general, you can get the analogous Server 2003 security event ID by subtracting 4096 from the Server 2008 event ID. In this case, you end up with an event ID of 528. windowsitpro.com/systems-management/… –  bshacklett Dec 16 at 16:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.