Background: Have a problem at work where I am constantly being locked out of my computer. We are in an environment that has a Domain Controller and we use Active Directory for authentication.

By going through my normal workflow while on the phone with Desktop Support we were able to track the bad password attempts that were causing the lockouts to an application: "Eclipse". This is the application I use to do software development. I immediately thought it was a cached password for our SVN server that's the culprit, however the desktop support person couldn't tell me which resource the password attempt was being made against (i.e. which URL for instance).

Question: Is there a way that I can monitor bad authentication requests made by an application on my desktop and find out what resource they are attempting it against?


To solve the problem, as others have suggested, I'd look at Eclipse - maybe there's an error log that's showing precisely what it's trying to do.

But to answer the question about tracking Active Directory calls:

The big guns for tracing this kind of stuff are PerfMon and ProcMon:

Here's a promising article that shows how to use PerfMon to monitor ActiveDirectory.

It will yield you stats like this:

DsDirSearch, Start, 0x000003F4, 126982224636242128, 61350, 440530, "DS", 3, 3,
1141178432, 2694848000, "", "deep", "OU=Sales,DC=rallencorp,DC=com", "0,

DsDirSearch, End, 0x000003F4, 126982224636342271, 61350, 440540, "DS", 3, 5,
1157955648, 2694848000, "0", "
(objectClass=user)) 0, 0

which would, for example mean that a user on the host with IP address performed an LDAP query for user objects in the Sales OU.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.