Insight for Active Directory Help

Insight for Active Directory Insight™ for Active Directory 2.0 Help

Copyright © 2003-2005

Winternals Software LP

www.winternals.com

Insight for Active Directory displays the LDAP (Lightweight Directory Access Protocol) calls made from any computer to the Active Directory and the corresponding results.

Installed on a single computer, the Administrator's Pak version of Insight for Active Directory can display and log all LDAP activity of any system it is installed on. Use Insight for Active Directory to pinpoint AD configuration issues, analyze application usage of Active Directory, and guide troubleshooting of applications and services that depend on Active Directory.

Example uses

You can install the Administrator's Pak and use Insight for Active Directory:

  • On computers running email, databases, ERP, and other applications to troubleshoot authentication issues.

  • On domain controllers to view replication events sent via LDAP.

  • On workstations to troubleshoot issues with Windows logon, printing, file sharing, and client applications.

  • You can double-click an event in the display to open AD Explorer™, an application that enables you to find, modify, add, and delete Active Directory objects and attributes.

Help topics

  • Getting Started

  • Using Insight for Active Directory

  • Using AD Explorer

  • How Do I...

Winternals Support Web Site

Access the Winternals Knowledge Base, view Frequently Asked Questions, or download product updates.

20041007b


Installing Insight for Active Directory

To install Insight for Active Directory

You must install the Insight for Active Directory component of the Winternals Administrator's Pak on the computer that you will use to display and log Active Directory LDAP activity. Remote monitoring is only available in the full version of Insight for Active Directory, available from http://www.winternals.com/insight

Insight for Active Directory functions only on Microsoft Windows 2000®, Windows XP®, and Windows Server 2003®. You must have an account with Administrator rights on a computer to view or log its activity.

To install Insight for Active Directory, insert the Administrator's Pak 5.0 Installation CD into the CD-ROM drive or run the setup program and follow the instructions on each screen. The Installation Wizard will guide you through the process.


Accessing Help

To access Help

Press F1 or choose Insight for Active Directory Help from the Help menu.


Licensing

The Insight for Active Directory version included with the Winternals Administrator's Pak is designed to operate on any licensed machine or for a specific licensed user, and cannot perform remote monitoring.

For assistance with licensing issues, or to upgrade to the full version of Insight for Active Directory 2.0, please contact sales@winternals.com.


Getting Technical Support

To provide feedback and get technical support

  • To access the Winternals Knowledge Base, view Frequently Asked Questions, or download updates visit our support Web site at www.winternals.com/support.


Getting Started

Insight for Active Directory To Start Insight for Active Directory

To begin using Insight for Active Directory, choose the Insight for Active Directory shortcut [image] from the Start menu.

When Insight for Active Directory starts you will be prompted to connect to a computer to begin viewing LDAP activity.

Insight for Active Directory Welcome Window

Select Do not show this message again if you do not want to view the message the next time that you start the program.


Connecting to a system

By default Insight for Active Directory starts without connecting to a computer. You must connect to the local computer to begin displaying.

To disconnect from a computer

Choose Disconnect from the Computer menu.

Note

  • Remote monitoring is a feature available only licensed with the full version of Insight for Active Directory. For assistance with licensing issues, or to upgrade to the full version of Insight for Active Directory, please contact sales@winternals.com.


Command-line options

You can use command-line parameters to set console startup options and to launch the monitoring service from a batch file or command window.

Syntax

adinsight [-q] [-o] [-c] [-t] [-port PortNumber] [-log FileName] [-fi IncludeString] [-fe ExcludeString] [-u UserName –p Password]...

Parameters

–q

Starts the console without opening the Filter dialog box. By default the Filter dialog box opens at startup if any filters are applied.

–o

Turns off event capture.

-c

Runs the monitor service and waits for a connection. This option can be used to remotely monitor the computer over a network that has File and Printer Sharing service disabled.

–t

Displays a notification icon on the Taskbar.

–port PortNumber

Overrides the default TCP port number for this session, where PortNumber is the new TCP port number.

-log FileName

Writes activity to a log file without opening the console, where FileName is the name of the output file.

–fi

Specifies an Include string for the Filter. Filter expression rules apply to the IncludeString text.

–fe

Specifies an Exclude string for the Filter. Filter expression rules apply to the ExcludeString text.

-?

Displays help at the command prompt.

You can use software management tools such as Microsoft SMS to roll out the monitoring service to remote computers if needed to connect over a network that has the File and Printer Sharing service disabled. Building a custom MSI for deployment via domain policy is also supported.


Using Insight for Active Directory

Insight for Active Directory Using Insight for Active Directory

Insight for Active Directory displays the LDAP (Lightweight Directory Access Protocol) calls made from any computer to the Active Directory, and the corresponding results.

Insight for Active Directory Display

Insight for Active Directory displays LDAP activity in two panes.

The Event Pane is the upper pane that displays LDAP events in order of occurrence.

The Details Pane is the lower pane that displays information about the event selected in the Output Pane.

To start using Insight for Active Directory

  1. Choose the Insight for Active Directory shortcut Insight for Active Directory Shortcut from the Start menu.

  2. Connect to a system to start viewing LDAP activity.

Common tasks

  • You can view information about LDAP functions that appear in the display.

  • You can quickly find event errors in the display.

  • You can highlight events that meet criteria you specify.

  • You can search for text in the display.

  • You can filter the display to show or hide processes whose names contain specified text.

  • You can choose the columns that appear in the display.

  • You can save the contents of the display and view formatted reports.

  • You can open AD Explorer to find, modify, add, and delete Active Directory objects and attributes.


Capturing Events

To capture events

To switch capture mode on and off, click the Capture Capture Toolbar Button toolbar button, choose Capture Events from the File menu, or press Ctrl+E. No data is collected when capture mode is off.

Note

By default events are captured when a new connection is made. To change the default capture mode choose Preferences from the Options menu and clear Automatically start to capture after connection.


Working with Multiple Windows

To work with multiple windows

You can open new windows to simultaneously view the activity of multiple computers.

  1. To open a new window, click the New Open New Windows toolbar button, choose New Window from the File menu or press Ctrl+N.

  2. After you open a new window you must connect to a system to begin capturing LDAP activity.

Note

You can display the activity of a particular computer in only one window.


Copying an Event

To copy an event

To copy a selected event to the Clipboard, chose Copy from the Edit menu or press Ctrl+C.


Finding Text in the Display

To find text in the display

To search for an occurrence of text in the Event Pane, click the Find Find Toolbar Button toolbar button, choose Find on the Edit menu, or press Ctrl+F. This action opens the Find dialog box.

Find Dialog Box

If the text you entered is found in the Event Pane, the matching event will be selected and Auto Scroll will be turned off to keep the line in the window.

  • To repeat a search down the event list press the F3 shortcut key.

  • To repeat a search up the event list press the Shift+F3 shortcut key.

Note

You can search only in columns that are visible in the Event Pane. To set the column display, choose Select Columns from the Options menu or from the context menu that appears when you right-click an item.


Clearing the Display

To clear the display

To clear the display click the Clear Clear Toolbar Button toolbar button or choose Clear Display from the Edit menu.

This action resets the sequence number to 0; it also resets the values displayed in the Time column if relative time is selected.


Filtering the Display

To filter the display

To display or hide processes whose names contain specified text substrings, or to add or exclude selected LDAP transactions, click the Filter Filter Toolbar Button toolbar button, choose Event Filter from the View menu, or press Ctrl+L.

This action opens the Event Filters dialog box.

Event Filters Dialog Box

  • To view only processes whose names contain specified substrings, type the text expression in the Include list.

  • To exclude processes whose names contain specified substrings, type the text expression in the Exclude list.

Using Filter Expressions

  • You can enter multiple expressions by separating each expression with a semicolon (;).

  • Use the Asterisks (*) as a wildcard character.

  • Do not include spaces in the expression unless you want the spaces to be part of the filter.

  • Filter expressions are case insensitive.

Selecting Displayed Transactions

  • To hide selected LDAP transactions, clear the corresponding check boxes.

  • To display events not commonly used for troubleshooting and configuration select Show Advanced Events.

To reset the Include and Exclude expressions and select the default LDAP transaction check boxes, click Reset to Default.

Notes

  • Changes in the Event Filters dialog box do not affect items already in the display.

  • When you start Insight for Active Directory with a Process Filter applied from a previous session, the Event Filters dialog box will open to confirm your filter settings. To start the console without opening the Event Filters dialog box, add the -q parameter to your startup command.


Setting History Depth

To set the history depth

By default older lines are discarded from the event list to stay within a specified history depth. To change history depth, click the History History Toolbar Button toolbar button, choose History Depth on the View menu, or press Ctrl+H.

This action opens the Event List History Depth dialog box.

Event History Depth Dialog Box

  • You can type or select a new value in the History Depth box or click Default to restore the default value of 50,000 lines.

  • You can type or select 0 in the History Depth box to retain an unlimited number of lines in the display.

Note

Turning off Auto Scroll temporarily sets the history depth to an unlimited number of lines so that new items will continue to appear in the display.


Setting Auto Scroll

To set auto scroll

By default the display scrolls to automatically show new activity.

To switch Auto Scroll on and off, click the Scroll Scroll Toolbar Button toolbar button, choose Auto Scroll on the View menu, or press Ctrl+A.

Note

Turning off Auto Scroll temporarily sets the History Depth to an unlimited number of lines so that new items will continue to appear in the display.


Highlighting Events

To highlight events in the display

To set display highlighting properties, choose Highlight Preferences on the Highlight menu or from the context menu that appears when you right-click an item in the Event Pane.

This action opens the Event Highlighting dialog box.

Event Highlighting Dialog Box

  • To highlight events in the same session handle as the selected item, click Sessions.

  • To highlight events with the same event handle as the selected item, click Related Items.

  • To highlight events whose process names contain specified text substrings, click Processes and type the text expression in the Process Name Filter list. Filter expression rules apply to text in the Process Name Filter.

  • To highlight events with errors, click Error Result.

  • To highlight events whose durations are longer than a time that you specify, click Highlight Events that take longer than and type the time in seconds.

  • To change a highlight color, click a Color button. This action opens the Highlight Color dialog box.

Notes

  • To switch all highlighting on and off, choose Enable Highlighting on the Highlighting menu.

  • The Next and Prev toolbar buttons are disabled when highlighting is disabled or Error Result is not selected.


Finding Event Errors

To find event errors

To go to the previous error in the Event Pane, click the Prev Previous Toolbar Button toolbar button or choose Previous Event Error from the context menu that appears when you right-click an item in the Event Pane.

To go to the next error in the Event Pane, click the Next Next Toolbar Button toolbar button or choose Next Event Error from the context menu that appears when you right-click an item in the Event Pane.

Note

The Next and Prev toolbar buttons are disabled when highlighting is off and when Error Result in the Event Highlighting dialog box is not selected.


Viewing Related Events

To view related events

To view a list of events with the same event handle as the selected item, choose View Related Events on the View menu or on the context menu that appears when you right-click the item.

This action opens the Related Transaction Events window.

Related Transaction Events Window

Note

Columns that appear in the window correspond to the columns visible in the Event Pane. To add or remove columns, choose Select Columns from the Options menu or from the context menu that appears when you right-click an item in the display.


Viewing Related Session Events

To view related session events

To view a list of events with the same LDAP session handle as the selected item, choose View Session Events on the View menu or on the context menu that appears when you right-click the item.

This action opens the Related Session Events window.

Related Session Events Window

Note

Columns that appear in the window correspond to the columns visible in the Event Pane. To add or remove columns, choose Select Columns from the Options menu or from the context menu that appears when you right-click an item in the display.


Setting the Column Display

To set the column display

To select the columns that appear in the display, choose Select Columns from the Options menu or from the context menu that appears when you right-click a column heading.

This action opens the Select Columns dialog box.

Select Columns Dialog Box

You can choose any of the following columns to appear in the Event Pane:

Sequence Number | the unique sequence number assigned to an event; gaps in sequence numbers may indicate buffer overflow resulting from excessive activity or from filtering that prevents some items from appearing in the display
Time | the time that the event occurred
Process | the name of the process making the LDAP call to the Active Directory
Request | the name of the LDAP function call
Type | whether the LDAP call is synchronous or asynchronous
Session | the LDAP session handle
Event ID | the LDAP event handle
Domain Controller | the domain controller processing the event
User | the user context of the LDAP function call
Input | the value passed from the Process to the Active Directory; if the object class of the transaction has appeared in the display, an object icon will appear in the Input column
Output | the value passed to the Process from the Active Directory
Result | the Result code returned by the function; Success results are not displayed unless you clear Suppress Success Status on the Options menu
Duration | the elapsed time between the call and the result

You can choose any of the following columns to appear in the Details Pane:

Parameter | the parameter names for the selected LDAP call
In/Out | whether the parameter is being sent or received by the application
Value | the value passed to or from the process making the LDAP call


Setting Time Display Options

To set time display options

To switch the Time column display between clock time and relative time, choose Clock Time from the Options menu or press Ctrl+T.

  • When clock time is selected you can switch the Time column display to show or hide milliseconds by choosing Show Milliseconds from the Options menu.

  • You can switch the number of decimal places displayed in the Time and Duration columns by choosing Show Simple Time from the Options menu. Simple time is displayed in the Time column only when relative time is selected.


Setting Other Display Options

To set other display options

  • To change the font size of items in the display, choose Font on the Options menu.

  • To keep the windows displayed when you switch programs or windows, choose Always on Top on the Options menu.

  • To switch the Request column between simple and full LDAP function names, click Show Simple Event Name on the Options menu. Examples of simple and full LDAP function names are:

Simple Name | get values length
Full Name | ldap_get_values_len

  • To switch the display of names in the Input column and Details Pane between simple and distinguished format, click Show Distinguished Name Format on the Options menu. Examples of equivalent simple and distinguished names are:

Simple Name | OA.Denver.Addesinc.com\Computers\RCHASE-2K3
Distinguished Name | CN=RCHASE-2K3,CN=Computers,DC=OA,DC=Denver,DC=Addesinc,DC=com

  • To switch the display of LDAP filter strings in the Input column and Details Pane between simple format (i.e., prefix notation) and standard format (i.e., infix notation), click Show Simple LDAP Filters on the Options menu. Examples of equivalent simple and standard format filter strings are:

Simple Format | (( NOT((showInAdvancedViewOnly=TRUE)) AND (samAccountType=805306368)) AND ((name=rchase-2k3*) OR (sAMAccountName=rchase-2k3*)))
Standard Format | (&(&(!(showInAdvancedViewOnly=TRUE))(samAccountType=805306368)) (|(name=rchase-2k3*) (sAMAccountName=rchase-2k3*)))

  • To switch on and off the display of Success status in the Result column, click Suppress Success Status from the Options menu.

  • To switch the display of strings in the Event ID column and Details Pane between friendly format (i.e., sequence numbers) and standard format (i.e., hexadecimal IDs), click Show Friendly Event IDs on the Options menu.

  • To switch the display of strings in the Session column and Details Pane between friendly format (i.e., sequence numbers) and standard format (i.e., hexadecimal IDs), click Show Friendly Session IDs on the Options menu.


Setting Program Preferences

To set other program preferences

To set other program preferences choose Preferences on the Options menu. This action opens the Preferences dialog box.

Preferences Dialog Box

  • To change the default capture mode when making a new connection, select or clear Automatically start to capture after connection.

  • To display a tray icon [image] on computers running the monitoring service, select Show Tray Icon for Monitor Service.

  • To change the TCP/IP port number for new connections, type the Port Number.

  • To suppress or display uncalled functions in Events with Time Results reports, select or clear Suppress uncalled functions in reports.


Viewing Process Information

To view process information

To view information about the process making an LDAP call, choose Process Information from the context menu that appears when you right-click an item in the Event Pane. This action opens the Process Information window.

Process Information Window

To view information about all processes

To view a list of all processes in the order that they appear in the Event Pane, choose Processes from the View menu. This action opens the Processes window.

You can double-click a process to open its Process Information window.


Viewing Event Information

To view event information

To view summary information about an LDAP function that appears in the Request column, choose Event Information from the context menu that appears when you right-click an item in the Event Pane. This action opens a pop-up window that displays the full name and description of the function.

Event Information Popup Window

To view detailed diagnostic information about the LDAP function, click the More Info hyperlink. This action opens a browser window with information from the MSDN Library Web site.


Insight for Active Directory commands

The following commands are available from the File menu.

  • New Window to open a new window

  • Capture Events to switch event capture on and off

  • Save to save the contents of the display as a trace file

  • Save As to save a trace file with a new name

  • Open to open a trace file

  • Export to Text File to save the contents of the display as text

  • Exit to close the active window

The following commands are available from the Edit menu.

  • Copy to copy the selected item to the Clipboard as text

  • Find to find text in the display

  • Clear Display to clear the display

The following commands are available from the View menu.

  • Event Filter to open the Event Filters dialog box

  • History Depth to set the history depth

  • Auto Scroll to switch auto scroll on and off

  • View Related Events to view related events

  • View Session Events to view related session events

  • HTML Reports to view HTML reports

  • Processes to view information about all processes in the display

The following commands are available from the Highlight menu.

  • Enable Highlighting to switch highlighting on and off

  • Highlight Preferences to open the Event Highlighting dialog box

The following commands are available from the Options menu.

  • Font to change the font size of items in the display

  • Always on Top to keep the windows displayed when you switch programs or windows

  • Select Columns to select the columns that appear in the display

  • Clock Time to switch the Time column display between clock time and relative time

  • Show Simple Event Name to switch the Request column between simple and full LDAP function names

  • Show Milliseconds to show or hide milliseconds

  • Show Simple Time to switch the number of decimal places displayed in the Time and Duration columns

  • Show Distinguished Name Format to switch the display of names between simple and distinguished format

  • Show Simple LDAP Filers to switch the display of LDAP filter strings between simple and standard format

  • Suppress Success Status to switch on and off the display of Success status

  • Show Friendly Event IDs to switch the display of Event ID strings between friendly and standard format

  • Show Friendly Session IDs to switch the display of Session ID strings between friendly and standard format

  • Preferences to open the Preferences dialog box

The following commands are available from the Computer menu.

  • Connect Local to connect to your local computer and begin monitoring local LDAP activity

  • Disconnect to disconnect and end monitoring LDAP activity

The following commands are available from the Help menu.

  • Insight for Active Directory Help to open help

  • License Agreement to view the end-user license agreement

  • About to open the product information window

The following toolbar buttons are available.

  • New New Window Toolbar Button to open a new window

  • Capture Capture Toolbar Button to switch event capture on and off

  • Scroll Scroll Toolbar Button to switch auto scroll on and off

  • Clear Clear Toolbar Button to clear the display

  • Filter Filter Toolbar Button to open the Event Filters dialog box

  • History History Toolbar Button to set the history depth

  • Find Find Toolbar Button to find text in the display

  • Connect Connect Toolbar Button to connect to the computer name on the toolbar

  • Previous Error Previous Error Toolbar Button to go to the previous error in the display

  • Next Error Next Error Toolbar Button to go to the next error in the display

When you select an item in the Event Pane the following commands are available from the context menu that appears when you right-click.

  • Explore to open AD Explorer

  • Event Information to view event information

  • Previous Event Error to go to the previous error in the display

  • Next Event Error to go to the next error in the display

  • Process Information to view process information

  • View Related Items to view related events

  • View Session Events to view related session events

Note

The Explore context menu item is unavailable when you right-click a call to the RootDSE (that is, the root of the directory data tree on a directory server), and double-clicking the item has no effect.


Saving and Viewing Data

Insight for Active Directory Trace File To Save and View Data

You can save the contents of the Insight for Active Directory display in several ways.

  • You can save the contents of the display as a trace file. Trace files retain their original detail when opened in the display, making them useful for sharing information with other users.

  • You can export the contents of the Event Pane as a text file.

  • You can copy a selected item to the Clipboard as text.

  • You can view and save the contents of the Event Pane as HTML formatted reports.


Working with trace files

Insight for Active Directory trace files retain their original detail when opened in the display. This makes them useful for sharing information with other users.

To save the contents of the display as a trace file

Choose Save on the File menu or press the Ctrl+S shortcut key.

To open a trace file

Choose Open from the File menu or press the Ctrl+O shortcut key. This action disconnects the window and opens the trace file.

Note

To start Insight for Active Directory with the contents of a trace file loaded in the display, double-click the trace file icon Trace File Icon or choose Open from the context menu that appears when you right-click.


Exporting to a Text File

To export to a text file

To export the contents of the Event Pane as a text file, choose Export to a Text File on the File menu or press the Ctrl+Alt+S shortcut key.

To copy a selected item to the Clipboard

Choose Copy from the Edit menu or press the Ctrl+C shortcut key.

To silently log activity

To log activity to a text file without opening the console, use the command-line -log option.

Note

You cannot open text files in the display.


Viewing HTML Reports

To View HTML Reports

You can view and save four types of HTML formatted reports.

  • Event Reports show all activity in the Event Pane.

  • Events with Details reports show all items in the Event Pane with corresponding information from the Details Pane.

  • Events with Time Results reports show histograms of LDAP calls in the Event Pane.

  • Highlighted Event reports show entries that are highlighted in the Event Pane.


Viewing Event Reports

To view event reports

To view a report of all items in the Event Pane, choose Events from the HTML Reports submenu of the View menu.

This action opens an HTML-formatted report in your Web browser window.

  • To view detailed diagnostic information about an LDAP function, click a hyperlink in the Request column.

  • To save the contents of the report, choose Save As from the File menu of your browser window.

Note

Columns that appear in the report correspond to the columns visible in the Event Pane. To add or remove columns, choose Select Columns from the Options menu or from the context menu that appears when you right-click an item in the display.


Viewing Events with Details

To view events with details

To view a report of all items in the Event Pane with corresponding Details Pane information, choose Events with Details from the HTML Reports submenu of the View menu.

This action opens an HTML-formatted report in your Web browser window.

Events with Details Report

  • To view detailed information about an LDAP function, click a hyperlink in the Request column.

  • To save the contents of the report, choose Save As from the File menu of your browser window.

Note

Columns that appear in the report correspond to the columns visible in the Event Pane. To add or remove columns, choose Select Columns from the Options menu or from the context menu that appears when you right-click an item in the display.


Viewing Events with Time Results

To view events with time results

To view a histogram report of LDAP calls in the Event Pane with Total Time, Longest Time, and Average Time statistics, choose Event Time Results from the HTML Reports submenu of the View menu.

This action opens an HTML-formatted report in your Web browser window.

Events with Time Results Report

  • To view detailed information about an LDAP function, click a hyperlink in the Active Directory Event column.

  • To save the contents of the report, choose Save As from the File menu of your browser window.

Note

To display uncalled functions, choose Preferences from the Options menu and clear Suppress uncalled functions in reports.


Viewing Highlighted Events

To view highlighted events

To view a report of highlighted entries in the Event Pane, choose Highlighted Events from the HTML Reports submenu of the View menu.

This action opens an HTML-formatted report in your Web browser window.

Highlighted Events Report

  • To view detailed information about an LDAP function, click a hyperlink in the Request column.

  • To save the contents of the report, choose Save As from the File menu of your browser window.

Note

Columns that appear in the report correspond to the columns visible in the Event Pane. To add or remove columns, choose Select Columns from the Options menu or from the context menu that appears when you right-click an item in the display.


Using AD Explorer

AD Explorer enables you to find, modify, add, and delete Active Directory objects and attributes.

AD Explorer Display

AD Explorer displays information in two panes.

The Object Pane is the left-hand pane that displays Active Directory objects.

The Attribute Pane is the right-hand pane that displays attributes of the object selected in the Object Pane.

To start AD Explorer

  • To start AD Explorer, choose the AD Explorer shortcut AD Explorer Shortcut from the Start menu.

  • You can also start AD Explorer by double-clicking an item in the Insight for Active Directory Event Pane or by choosing Explore from the context menu that appears when you right-click. This action opens AD Explorer to the Active Directory object referenced in the LDAP call.

Common tasks

  • You can connect to Active Directory domains and remember the connections for future sessions.

  • You can search for objects in the Active Directory.

  • You can inspect the properties and edit the security permissions of objects.

  • You can rename, insert, and delete objects.

  • You can modify, insert, and delete object attributes.

Notes

  • Double-clicking a call to the RootDSE (that is, the root of the directory data tree on a directory server) in the Insight for Active Directory Event Pane has no effect, and the Explore context menu item is unavailable when you right-click.

  • You should use AD Explorer to make changes only if you know precisely what effect the changes will have, as making incorrect changes can cause service and application failures.


Connecting to a Domain

To connect to a domain

  • Choose Connect from the File menu and type the domain, user name, and password and click OK to make the connection.

  • You can also click OK without typing any information to connect to the default domain using your current logon credential information.

To remember a connection

Select Remember this Connection and type a connection name.

To remove a domain

Select it in the Object Pane and choose Remove from the File menu or from the context menu that appears when you right-click.


Navigating AD Explorer

To navigate AD Explorer

Select an object in the Object Pane to view its attributes in the Attribute Pane.

  • Click the Back Back Toolbar Button toolbar button to go to the previous item in the object history.

  • Click the Forward Forward Toolbar Button toolbar button to go to the next item in the object history.

  • Click the History History Toolbar Button toolbar button to choose from a list of objects selected in the current session.

  • Choose Add to Favorites on the Favorites menu to add the selected object to the Favorites list.

Note

To rename or delete a Favorite, choose Rename or Delete from the context menu that appears when you right-click it on the Favorites menu.


Inspecting Object Properties

To inspect object properties

To inspect the properties of a selected object, choose Properties from the context menu that appears when you right-click. This action opens the Object Properties dialog box.

Object Properties Dialog Box

  • To go to the Schema class for the object click Go to on the Object Properties tab.

  • To edit security permissions for the object click the Security tab.

  • To view the object attributes click the Attributes tab.

Notes

  • You can view RootDSE attributes by selecting a RootDSE node RootDSE Node in the AD Explorer Object Pane, choosing Properties from the context menu that appears when you right-click, and clicking the RootDSE Attributes tab.

  • You must have sufficient rights to change security permissions.


Inspecting Attribute Properties

To inspect attribute properties

To inspect the properties of a selected attribute, choose Properties from the context menu that appears when you right-click. This action opens the Attribute Properties dialog box.

Attribute Properties Dialog Box

To go to the Schema property for the attribute click Go to.


Searching Active Directory

To search the Active Directory

To search for objects in the Active Directory, choose New Search from the Search menu or click the Search Search Toolbar Button toolbar button. This action opens the Search Directory dialog box.

Search Directory Dialog Box

  • To add a search criterion, enter the Attribute information and click Add.

  • To remove a search criterion, select it from the list and click Remove.

  • To go to an item in the search results window, double-click it or select it and press Enter.

  • To save a set of search criteria, click Save. Saved searches appear on the Search menu.

Notes

  • When opened from the Search menu, the Search Directory dialog box searches only the Domain Domain Container container of the selected object.

  • You can search a selected container (including a Configuration Configuration Container or Schema Schema Container container) by choosing Search Container from the context menu that appears when you right-click. This action opens the Search Directory dialog box with the container name added as a search criterion.

  • You can rename or delete a saved search by choosing Rename or Delete from the context menu that appears when you right-click it on the Search menu.


AD Explorer commands

The following commands are available from the File menu.

  • Connect to connect to a domain

  • Remove to disconnect a selected domain

  • Exit to close AD Explorer

The following commands are available from the Edit menu when you select an object.

  • Properties to open the Object Properties dialog box

  • Rename to rename the object

  • Delete to delete the object

  • New Object to insert a new object

  • Copy Object Name to copy the object name to the Clipboard

The following commands are available from the Edit menu when you select an attribute.

  • Properties to open the Attribute Properties dialog box

  • Modify to edit the attribute

  • Delete to delete the attribute

  • New Attribute to insert a new attribute

The following commands are available from the Favorites menu.

  • Add to Favorites to add the current selection to the Favorites list

  • You can also choose any Favorites that you have saved.

The following commands are available from the Search menu.

  • New Search to open the Search Directory dialog box

  • You can also choose any searches that you have saved.

The following commands are available from the History menu.

  • Forward to go to the next selected object

  • Back to go to the previously selected object

  • All to choose from a list of objects selected in the current session

The following commands are available from the Help menu.

  • AD Explorer Help to open help

  • About for product information

The following toolbar buttons are available.

  • Connect to AD Connect to AD Toolbar Button to connect to an Active Directory domain

  • Search Search Toolbar Button to search for an object

  • Properties Properties Toolbar Button to view the properties of the selected object or attribute

  • Help Help Toolbar Button to open help

  • Back Back Toolbar Button to go to the previous item in the object history

  • Forward Forward Toolbar Button to go to the next item in the object history

  • History History Toolbar Button to choose from a list of objects selected in the current session


Object commands

When you select an object in the Object Pane the following commands are available from the context menu that appears when you right-click.

  • Properties to open the Object Properties dialog box

  • Search Container to open the Search Directory dialog box

  • Rename to rename the object

  • Delete to delete the object

  • New Object to insert a new object

  • Copy Object Name to copy the object name to the Clipboard

Note

You must have sufficient rights to modify, delete, or add an object.


Attribute commands

When you select an attribute in the Attribute Pane the following commands are available from the context menu that appears when you right-click.

  • Properties to open the Attribute Properties dialog box

  • Modify to edit the attribute

  • Delete to delete the attribute

  • New Attribute to insert a new attribute

Note

You must have sufficient rights to modify, delete, or add an attribute.


How Do I...

Change color highlighting

Connect without file and printer sharing

Display only selected events

Edit the attributes of AD objects in the display

Log system activity

Save events that appear in the display

Troubleshoot logon issues

View different columns in the display


Change color highlighting

You can set color highlighting properties of the display by choosing Highlight Preferences from the Highlight menu or from the context menu that appears when you right-click an item in the Event Pane.


Display only selected events

You can display or hide processes whose names contain specified text or add and exclude selected transactions by clicking the Filter Filter Toolbar Button toolbar button, choosing Event Filter on the View menu, or pressing Ctrl+L.


Edit the Attributes of AD Objects in the Display

Edit the attributes of AD objects that appear in the display

You can double-click an event in the display or choose Explore from the context menu that appears when you right-click to open AD Explorer, an application that enables you to find and modify the attributes of objects in the Active Directory.

Note

The Explore context menu item is unavailable when you right-click a call to the RootDSE (that is, the root of the directory data tree on a directory server), and double-clicking the item has no effect.


Log system activity

You can use the command-line -log option to write activity to a log file without opening the console.


Save Events in the Display

Save events that appear in the display

You can save the contents of the Insight for Active Directory display in four ways.

  • You can save the contents of the display as a trace file. Trace files retain their original detail when opened in the display, making them useful for sharing information with other users.

  • You can export the contents of the Event Pane as a text file.

  • You can copy a selected item to the Clipboard as text.

  • You can view and save the contents of the Event Pane as HTML formatted reports.


Troubleshoot logon issues

You can view and troubleshoot a computer's logon activity by starting the monitoring service before logon, either by connecting to the system from another machine or by starting the monitoring service with a logon script command.

You can monitor the logon activity of your local computer by starting Insight for Active Directory with the -log option in a logon script.


View different columns in the display

You can select the columns that appear in the display by choosing Select Columns from the Options menu or from the context menu that appears when you right-click an item in the Event Pane.


_Popup Asynchronous

When a client calls an asynchronous function, it does not need to wait for the operation to complete to perform other tasks. Asynchronous functions return a unique message ID and a result code indicating if the request was successfully sent to the server.


_Popup Clock Time

Clock time is the time of day that an event occurred.

To display clock time, select Clock Time on the Options menu.


_Popup Filter Expression Rules

Filter Expression Rules

  • You can type multiple expressions by separating each expression with a semicolon (;).

  • Use the asterisk (*) as a wildcard character.

  • Do not include spaces in the expression unless you want the spaces to be part of the filter.

  • Filter expressions are a case-insensitive.


_Popup More Info Link

Click the More Info hyperlink to view detailed diagnostic information about the LDAP function. This action opens a browser window with information from the MSDN Library Web site.


_Popup Object Icon

For transactions whose object class has appeared in the Insight for Active Directory display, an object icon will appear in the Input column. Object icons correspond to the following object classes:

builtinDomain Object Icon | builtinDomain | nTFRSSettings Object Icon | nTFRSSettings
Computer Object Icon | computer | nTFRSSubscriber Object Icon | nTFRSSubscriber
Configuration Object Icon | configuration | nTFRSSubscriptions Object Icon | nTFRSSubscriptions
Contact Object Icon | contact | organizationalPerson Object Icon | organizationalPerson
Container Object Icon | container | organizationalUnit Object Icon | organizationalUnit
domainDNS Object Icon | domainDNS | person Object Icon | person
domainPolicy Object Icon | domainPolicy | pKICertificateTemplate Object Icon | pKICertificateTemplate
foreignSecurityPrincipal Object Icon | foreignSecurityPrincipal | printQueue Object Icon | printQueue
group Object Icon | group | remoteMailRecipient Object Icon | remoteMailRecipient
interSiteTransport Object Icon | interSiteTransport | rpcContainer Object Icon | rpcContainer
interSiteTransportContainer Object Icon | interSiteTransportContainer | server Object Icon | server
licensingSiteSettings Object Icon | licensingSiteSettings | serversContainer Object Icon | serversContainer
mSMQConfiguration Object Icon | mSMQConfiguration | site Object Icon | site
mSMQEnterpriseSettings Object Icon | mSMQEnterpriseSettings | siteLink Object Icon | siteLink
mSMQQueue Object Icon | mSMQQueue | siteLinkBridge Object Icon | siteLinkBridge
mSMQSettings Object Icon | mSMQSettings | sitesContainer Object Icon | sitesContainer
mSMQSiteLink Object Icon | mSMQSiteLink | storage Object Icon | storage
nTDSConnection Object Icon | nTDSConnection | subnet Object Icon | subnet
nTDSDSA Object Icon | nTDSDSA | subnetContainer Object Icon | subnetContainer
nTDSSiteSettings Object Icon | nTDSSiteSettings | user Object Icon | user
nTFRSMember Object Icon | nTFRSMember | volume Object Icon | volume
nTFRSReplicaSet Object Icon | nTFRSReplicaSet |  |


_Popup Relative Time

Relative time is the difference between the time of an event and the time of the first event in the display.

To display relative time, clear Clock Time on the Options menu.


_Popup Synchronous

When a client calls a synchronous function, it waits for the operation to complete before executing any subsequent code. Synchronous functions return Success if successful and an error code if not.


Connect without file and printer sharing

You can view remote computer activity on networks with File and Printer Sharing disabled by running the adinsight executable with the -c option on computers to be monitored.


_Popup Event Handle

The event handle denotes related LDAP events within a particular session.


_Popup Session Handle

The session handle is a pointer to a data type representing the LDAP session. The session handle is created by an LDAP initialize request and passed to subsequent calls pertaining to the session.


The AD Explorer Display

http://www.microsoft.com/windows2000/techinfo/reskit/en-us/default.asp?url=/windows2000/techinfo/reskit/en-us/distrib/dsbg_dat_favt.asp

The right-hand pane displays 4 partition subtrees for each connected domain controller:

Domain Node Domain Node

The Domain node stores users, computers, groups, and other objects for a specific domain

Configuration Subnode Configuration Subnode

The Configuration subnode stores configuration objects for the entire forest.

Schema subnode Schema Subnode

The Schema subnode displays the container that stores class and attribute definitions for all existing and possible Active Directory objects.

Deleted Objects subnode Deleted Objects Subnode

The Deleted Objects subnode contains objects that have been deleted. Deleted objects are stored as tombstones, which are eventually removed by garbage collection.


View the activity of multiple systems

You can simultaneously view the activity of additional computers by opening new windows and connecting to the systems.