ADMIN

Management
Sysinternals
System monitoring with Sysinternals
Health Check
© Denis Tevekov, 123RF.com
Administrators don’t need a massive arsenal of tools just to monitor a couple of
systems. With Microsoft’s free Sysinternals suite, admins can handle all sorts of
tasks. By Thomas Joos
The Sysinternal tools are free tools
from Microsoft that can help Windows
administrators handle many
tasks. This article introduces the
Sysinternal tools that are useful for
system monitoring. All of the tools
described here can be downloaded
free of charge from the Microsoft site
[1], either as individual downloads or
as part of the Sysinternals suite.
One advantage of the Sysinternals
utilities is that you don’t need to install
them, so they can be launched
conveniently from a USB stick. When
launched for the first time, the programs
display a license dialog; you
can suppress this dialog with the
/accepteula option, which can be
useful in scripting. Unfortunately, this
option does not work for all of the
Sysinternal tools.
The programs only run on a Windows
system as of Windows 2000 Server.
For this article, I used Windows
Server 2008 R2 and Windows 7.
Windows Server 2008 R2, Windows
Server 2008, Windows Vista, and
Windows 7 do not support access to
the hidden System $ shares such as
C$, or admin$ as easily as Windows
XP or Windows Server 2003; the computers
do not belong to a Windows
domain because the new operating
systems block access to administrative
shares by authentication of local
user accounts.
Some Sysinternal tools, such as
PSInfo.exe, require access to the
admin share and thus will not work
at first. To allow access, you must
enable local logins to administrative
shares in the Registry of standalone
computers. To do so, launch the Registry
Editor by typing regedit, then
navigate to HKEY_LOCAL_MACHINE\SOFT‐
WARE\Microsoft\Windows\CurrentVersion\Policies\System.
Create a new
Dword entry with the label LocalAccountTokenFilterPolicy,
set the value
to 1, then restart the computer.
LDAP Microscope
Insight for Active Directory, also
known as AdInsight, lets you monitor
the LDAP connections on a domain
controller in real time with a GUI.
The user interface is similar to the
Sysinternal tools Regmon and Filemon.
The tool investigates calls to
the wldap32.dll file, which most programs,
including Exchange, use for
LDAP-based access to Active Directory
per LDAP.
AdInsight lists all requests including
those that are blocked. This gives
administrators an easy option for analyzing
authentication problems with
Active Directory-aware programs and
identifying clients and servers that set
up a connection to the domain controller.
AdInsight logs all requests issued
to domain controllers and stores
them as an HTML report or text file
for troubleshooting purposes. The
logfile contains the client request and
responses that the client received via
LDAP.
AdInsight also logs access to system
services (Figure 1). When a program
such as Exchange accesses the domain
controller, the window fills with
information; then, you can right-click
to display details of the individual entries,
as well as filter the display via
the menu.
The display also includes the name
of the accessing user. Unfortunately,
AdInsight only lets you monitor local
access; over-the-wire diagnostics
via remote access are not supported.
However, AdInsight’s search function
does let you filter by process, error, or
request response. The tool selects the
response to let you perform specific
monitoring.
74 Admin 01 www.admin-magazine.com