Windows sysinternals

296 Part II Usage Guide
You can script AdExplorer to create a snapshot by starting it with the –snapshot commandline
option. The option requires two parameters: the connection string and the snapshot
path. Connection string is just the server name, or you can use a pair of double quotes to
specify the default directory server. It is not possible to specify alternate credentials for the
connection. To snapshot the default domain using current credentials, use this command:
adexplorer -snapshot "" c:\snapshots\snapshot1.dat
AdExplorer Configuration
AdExplorer’s configuration settings are stored in two separate registry keys. The EulaAccepted
value is stored in HKCU\Software\Sysinternals\Active Directory Explorer. The rest of
AdExplorer’s settings—including Favorites, snapshot paths, and other dialog box settings—
are stored in HKCU\Software\MSDART\Active Directory Explorer.
AdInsight
AdInsight is a real-time monitoring utility that tracks LDAP API calls. Because LDAP is the
communication protocol used by Active Directory, AdInsight is ideal for troubleshooting
Active Directory client applications.
AdInsight uses DLL injection techniques to intercept calls that applications make in the
Wldap32.dll library, which is the standard Windows library that implements low-level LDAP
functionality, and upon which higher-level libraries such as ADSI (Active Directory Service
Interfaces) rely. Unlike network monitoring tools, AdInsight intercepts and interprets all
client-side APIs, including those that do not result in transmission to a server.
AdInsight monitors any process into which it can load its tracing DLL. It works most reliably
when it is executed in the same security context and on the same desktop as the application
being monitored. If the client application does not have administrative rights, AdInsight
should not either.
To monitor Windows services, AdInsight needs to execute in Terminal Services session 0. On
Windows XP and Windows Server 2003, this is typically the case when the AdInsight user
has logged on at the console. However, on Windows Vista and newer, the interactive user
desktop is never in session 0. You can start AdInsight in session 0 by running the following
PsExec command with administrative rights:
psexec -d -i 0 adinsight.exe
AdInsight will then be able to inject its tracing DLL into other processes in session 0, including
Windows services.
www.it-ebooks.info