Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Background: Have a problem at work where I am constantly being locked out of my computer. We are in an environment that has a Domain Controller and we use Active Directory for authentication.

By going through my normal workflow while on the phone with Desktop Support we were able to track the bad password attempts that were causing the lockouts to an application: "Eclipse". This is the application I use to do software development. I immediately thought it was a cached password for our SVN server that's the culprit, however the desktop support person couldn't tell me which resource the password attempt was being made against (i.e. which URL for instance).

Question: Is there a way that I can monitor bad authentication requests made by an application on my desktop and find out what resource they are attempting it against?

share|improve this question
    
I suggest you direct this question toward the Eclipse community. –  Ramhound Sep 4 '12 at 15:58
    
@Ramhound the Eclipse community isn't going to be able to tell him how to monitor for those attempts. –  ekaj Sep 4 '12 at 17:06
1  
useful?: ( wiki.eclipse.org/EclipseLink/Examples/JPA/Logging ) –  horatio Sep 4 '12 at 17:27
add comment

1 Answer

up vote 2 down vote accepted

To solve the problem, as others have suggested, I'd look at Eclipse - maybe there's an error log that's showing precisely what it's trying to do.

But to answer the question about tracking Active Directory calls:

The big guns for tracing this kind of stuff are PerfMon and ProcMon:

Here's a promising article that shows how to use PerfMon to monitor ActiveDirectory: http://robbieallen.com/downloads/Recipe15-11.htm

It will yield you stats like this:

DsDirSearch, Start, 0x000003F4, 126982224636242128, 61350, 440530, "DS", 3, 3,
1141178432, 2694848000, "192.168.5.26", "deep", "OU=Sales,DC=rallencorp,DC=com", "0,
0

DsDirSearch, End, 0x000003F4, 126982224636342271, 61350, 440540, "DS", 3, 5,
1157955648, 2694848000, "0", "
(&(objectCategory=CN=Person,CN=Schema,CN=Configuration,DC=rallencorp,DC=com) 
(objectClass=user)) 0, 0

which would, for example mean that a user on the host with IP address 192.168.5.26 performed an LDAP query for user objects in the Sales OU.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.