Otdfbt

I had been using ADInsight from Sysinternals to trace Active Directory calls from my workstation, but the application has failed.

Where previously the Active Directory events were traced and logged, now the window remains blank, whether the application is in capture mode or not. I have run as Administrator, rebooted, downloaded a new version; none of those actions has returned the program to a functional state.

The Sysinternals forums don't offer much hope, since this tool is known to fail often.

Is there tool that has similar functionality?

Questions

Does the tool fail when run from another workstation with your account? Yes

Does it fail from your (and/or) another workstation using someone else's account? Yes

Is there anything in the event log of your workstation? No

There are known issues with ADInsight and it is no longer supported or developed. It has issues loading its DLL in certain environments, specifically on VMs (see http://forum.sysinternals.com/adinsight-doesnt-work-hangs_topic18891.html and http://forum.sysinternals.com/adinsight-operation_topic18963.html)

The best solution I have found is to turn on Active Directory Diagnostic Logging as described at http://www.activedir.org/Articles/tabid/54/articleType/ArticleView/articleId/41/Default.aspx. Basically, you want to set the following registry values:

Path: HKLMSYSTEMCurrentControlSetServicesNTDSDiagnostics15 Field Engineering
Type: DWORD
Value: 5

Path: HKLMSYSTEMCurrentControlSetServicesNTDSParametersExpensive Search Results Threshold
Type: DWORD
Value: 1

These changes do not require a reboot but are set per server, so implementing for an entire forest/domain would best be done via Group Policy Preferences. Once set you will find the resulting logs in the Directory Service event log on the DC. They are not exactly parse-friendly but can be wrangled with some regex. The best part is it requires no external utilities/code.

I would be remiss if I didn't mention that this level of logging may incur a performance penalty on a production DC. In my test environment, with only two DCs doing next to nothing, I see ~10-20 events/minute from just this setting.

I know this is an old question but I've just found out that starting from Windows Vista/2008, the windows LDAP client supports ETW.

The reference for the tracing flags is here.

ADInsight was updated this year to address these issues.

Source: http://blogs.technet.com/b/sysinternals/archive/2015/10/27/update-autoruns-v13-5-sigcheck-v2-3-rammap-v1-4-bginfo-v4-21-sysmon-v3-11-adinsight-v1-2.aspx