Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We recently starting testing the ADAudit tool and turned on some new auditing features in AD.

I have an LDAP Modify action in a custom program I've written that updates very large memberships for groups in AD (10,000+). It looks like it has started failing because of the auditing changes. This is the event description from the Directory Service Event Log.

While logging audit events for the following object, the directory service reached the maximum number of audit events that could be cached in memory at any given time. As a result of reaching this limit, the operation was aborted.

Maximum number of audit events that can be cached: 17000

Does anyone know how to change the maximum limit for this? I can find no information about it anywhere.

share|improve this question
    
Is this is an old group that was created before before switching over to Windows 2003 Forest functional level? –  Greg Askew Jan 18 '13 at 19:24
    
I'd be curious under which event id & source this event was logged? –  Lucky Luke Jun 25 '13 at 3:26

1 Answer 1

up vote 4 down vote accepted

You know you've gotten yourself into a pickle if the only relevant search result to your problem is the Serverfault question you just asked.

Give this a try:

HKLM\System\CurrentControlSet\services\NTDS\Parameters\Maximum Audit Queue Size

You'll have to create the key as it most likely won't exist. It's completely undocumented (publicly) by Microsoft, and therefore most likely not supportable. The only reason I know that Directory Services checks for the existence of that key is because I ran Procmon and restarted AD DS to see what reg keys it searches for.

I haven't tested it out nor do I have an Active Directory as crazy as yours to test it on, but I doubt you'll get a better answer without contacting Microsoft support.

Most of the other keys there seem to be DWORDS, so I would start with that.

lsass.exe searches for it during AD DS startup using the function RegQueryValueExA. Unfortunately I can't see the parameters passed to the function so I can't tell you exactly what type of registry key it'll need to be. You'll just have to test.

share|improve this answer
    
Awesome, thanks for finding that!. That's the registry entry the error said to modify, but it didn't exist. We'll give it a go on Tuesday when I'm back at the office and let you know if that solves it. –  Matt Jan 19 '13 at 21:45
1  
Wait... the error message told you to modify that entry? Agh! That would have been nice to know before firing up Process Monitor... oh well, it was fun. I hope it does the trick! –  Ryan Ries Jan 19 '13 at 22:27
    
Yes...I should have put the whole error in my question, sorry about that. But it worked! Thanks! –  Matt Jan 22 '13 at 15:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.