Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Background: Have a problem at work where I am constantly being locked out of my computer. We are in an environment that has a Domain Controller and we use Active Directory for authentication.

By going through my normal workflow while on the phone with Desktop Support we were able to track the bad password attempts that were causing the lockouts to an application: "Eclipse". This is the application I use to do software development. I immediately thought it was a cached password for our SVN server that's the culprit, however the desktop support person couldn't tell me which resource the password attempt was being made against (i.e. which URL for instance).

Question: Is there a way that I can monitor bad authentication requests made by an application on my desktop and find out what resource they are attempting it against?

share|improve this question
I suggest you direct this question toward the Eclipse community. – Ramhound Sep 4 '12 at 15:58
@Ramhound the Eclipse community isn't going to be able to tell him how to monitor for those attempts. – cutrightjm Sep 4 '12 at 17:06
useful?: ( ) – horatio Sep 4 '12 at 17:27
up vote 2 down vote accepted

To solve the problem, as others have suggested, I'd look at Eclipse - maybe there's an error log that's showing precisely what it's trying to do.

But to answer the question about tracking Active Directory calls:

The big guns for tracing this kind of stuff are PerfMon and ProcMon:

Here's a promising article that shows how to use PerfMon to monitor ActiveDirectory:

It will yield you stats like this:

DsDirSearch, Start, 0x000003F4, 126982224636242128, 61350, 440530, "DS", 3, 3,
1141178432, 2694848000, "", "deep", "OU=Sales,DC=rallencorp,DC=com", "0,

DsDirSearch, End, 0x000003F4, 126982224636342271, 61350, 440540, "DS", 3, 5,
1157955648, 2694848000, "0", "
(objectClass=user)) 0, 0

which would, for example mean that a user on the host with IP address performed an LDAP query for user objects in the Sales OU.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .