Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I had been using ADInsight from Sysinternals to trace Active Directory calls from my workstation, but the application has failed.

Where previously the Active Directory events were traced and logged, now the window remains blank, whether the application is in capture mode or not. I have run as Administrator, rebooted, downloaded a new version; none of those actions has returned the program to a functional state.

The Sysinternals forums don't offer much hope, since this tool is known to fail often.

Is there tool that has similar functionality?

Questions

Does the tool fail when run from another workstation with your account? Yes

Does it fail from your (and/or) another workstation using someone else's account? Yes

Is there anything in the event log of your workstation? No

share|improve this question
2  
How did it fail? Perhaps you should be asking a question about the problem you are having with it. –  Zoredache Apr 24 '12 at 17:40
    
Thanks, did so. –  mmcglynn Apr 24 '12 at 17:43
    
Troubleshoot this to find out if the problem is your account, your workstation, or AD. Does the tool fail when run from another workstation with your account? Does it fail from your (and/or) another workstation using someone else's account? Is there anything in the event log of your workstation? –  mfinni Apr 24 '12 at 17:50
    
Hm - OK, if the tool is known buggy (I've never used it myself), and it happens on multiple workstations and accounts, then it's either the tool or your AD. It might help you if you knew what changed in your AD between when Insight worked and when it didn't. I don't have an alternative tool to suggest. What problem are you solving with this tool - are you debugging an AD tool that your company develops? –  mfinni Apr 24 '12 at 18:39
1  
it may be that its a 64 bit application or 64 bit workstation, the tool only works with 32 bit at the moment. –  user125968 Jun 26 '12 at 0:56
show 3 more comments

1 Answer

up vote 3 down vote accepted

There are known issues with ADInsight and it is no longer supported or developed. It has issues loading its DLL in certain environments, specifically on VMs (see http://forum.sysinternals.com/adinsight-doesnt-work-hangs_topic18891.html and http://forum.sysinternals.com/adinsight-operation_topic18963.html)

The best solution I have found is to turn on Active Directory Diagnostic Logging as described at http://www.activedir.org/Articles/tabid/54/articleType/ArticleView/articleId/41/Default.aspx. Basically, you want to set the following registry values:

Path: HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics\15 Field Engineering
Type: DWORD
Value: 5

Path: HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\Expensive Search Results Threshold
Type: DWORD
Value: 1

These changes do not require a reboot but are set per server, so implementing for an entire forest/domain would best be done via Group Policy Preferences. Once set you will find the resulting logs in the Directory Service event log on the DC. They are not exactly parse-friendly but can be wrangled with some regex. The best part is it requires no external utilities/code.

I would be remiss if I didn't mention that this level of logging may incur a performance penalty on a production DC. In my test environment, with only two DCs doing next to nothing, I see ~10-20 events/minute from just this setting.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.