{"id":16480894,"url":"https://github.com/ramblingcookiemonster/psldapquerylogging","last_synced_at":"2025-10-27T17:30:46.416Z","repository":{"id":72634518,"uuid":"43460321","full_name":"RamblingCookieMonster/PSLDAPQueryLogging","owner":"RamblingCookieMonster","description":"PowerShell module to simplify configuring AD LDAP diagnostic logging","archived":false,"fork":false,"pushed_at":"2015-10-05T13:56:03.000Z","size":140,"stargazers_count":8,"open_issues_count":0,"forks_count":8,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-02-01T07:22:22.348Z","etag":null,"topics":["active-directory","ldap","powershell","powershell-modules"],"latest_commit_sha":null,"homepage":"http://ramblingcookiemonster.github.io/Evil-LDAP-Queries/","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/RamblingCookieMonster.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-09-30T21:29:35.000Z","updated_at":"2024-12-29T06:05:31.000Z","dependencies_parsed_at":"2023-03-06T09:45:29.373Z","dependency_job_id":null,"html_url":"https://github.com/RamblingCookieMonster/PSLDAPQueryLogging","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RamblingCookieMonster%2FPSLDAPQueryLogging","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RamblingCookieMonster%2FPSLDAPQueryLogging/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RamblingCookieMonster%2FPSLDAPQueryLogging/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RamblingCookieMonster%2FPSLDAPQueryLogging/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/RamblingCookieMonster","download_url":"https://codeload.github.com/RamblingCookieMonster/PSLDAPQueryLogging/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":238527316,"owners_count":19487196,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["active-directory","ldap","powershell","powershell-modules"],"created_at":"2024-10-11T13:05:40.350Z","updated_at":"2025-10-27T17:30:46.042Z","avatar_url":"https://github.com/RamblingCookieMonster.png","language":"PowerShell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# PSLDAPQueryLogging\n\nThis module simplifies enabling the [LDAP query diagnostic logging](http://blogs.technet.com/b/askpfeplat/archive/2015/05/11/how-to-find-expensive-inefficient-and-long-running-ldap-queries-in-active-directory.aspx) discussed by Mark Morowczynski.\n\nThis is a quick hit, didn't spend much time generalizing or testing. Pull requests would be welcome!\n\nFunctions:\n\n* **Test-LDAPQueryLoggingPrerequisites** : Check to see if a domain controller meets the prerequisites for this logging\n* **Enable-LDAPQueryLogging**            : Enable diagnostic logging and set parameters as discussed by Mark\n* **Get-LDAPQueryLogging**               : Check the current state, including whether logging is enabled, and parameter values.\n* **Disable-LDAPQueryLogging**           : Disable diagnostic logging and set parameters back to defaults\n\n## Prerequisites:\n\n* Access to the domain controller\n* Server 2012 R2 *or*\n* Server 2008, 2008 R2, or 2012 with [KB2800945](https://support.microsoft.com/en-us/kb/2800945/en-us)\n* Directory Services event log size is large enough\n\n## Instructions\n\n```powershell\n# Download PSLDAPQueryLogging\n# https://github.com/RamblingCookieMonster/PSLDAPQueryLogging/archive/master.zip\n# Unblock the archive\n# Copy the PSLDAPQueryLogging module to one of your module paths ($env:PSModulePath -split \";\")\n\n# Import the module\n    Import-Module PSLDAPQueryLogging -force\n\n# Get commands from the module\n    Get-Command -module PSLDAPQueryLogging\n\n# Get help for a command\n    Get-Help Test-LDAPQueryLoggingPrerequisites -Full\n   \n# Check if a domain controller has the prerequisites\nTest-LDAPQueryLoggingPrerequisites -ComputerName DS1, DS2, DS3\n\n# Enable logging temporarily on DS1 and DS2\nEnable-LDAPQueryLogging -ComputerName DS1, DS2\n\n# Verify the registry settings....\nGet-LDAPQueryLogging -ComputerName DS1, DS2\n\n# Collect your logs!\n# Many ways to do this. Not PowerShell, but I find wevtutil to be quite fast.\nInvoke-Command -ComputerName DS1, DS2 {wevtutil epl 'Directory Service' \"\\\\$ENV:ComputerName\\c$\\$ENV:ComputerName-Evil.evtx\"}\n\n# Disable the logging...\nDisable-LDAPQueryLogging -ComputerName DS1, DS2\n\n# Parse events as desired, perhaps using Ming's script\n    # https://gallery.technet.microsoft.com/scriptcenter/Event-1644-reader-Export-45205268\n\n```\n\n## Example\n\nLet's pretend LSASS is running a bit hot on all the domain controllers in your environment. This snippet will...\n\n* Get all domain controllers (ActiveDirectory module)\n* Enable diagnostic logging (prerequisites assumed)\n* Wait 10 minutes\n* Pull the eventlogs back to your system\n* Disable diagnostic logging\n\n```powershell\n# Import the module\n    Import-Module PSLDAPQueryLogging -force\n\n# Get domain controllers\n$DCs = Get-ADDomainController -Filter * | Select -ExpandProperty Name\n\n# Enable logging temporarily on the domain controllers\n# We set search time threshold covering queries under over 30 ms (default is 100 ms)\n$DCs | Enable-LDAPQueryLogging -SearchTimeThreshold 30\n\n# Wait a bit\n\"$(Get-Date): Sleeping 10 minutes...\"\nStart-Sleep -Seconds (10*60)\n\n# Collect your logs!\n# Many ways to do this. Not PowerShell, but I find wevtutil to be quite fast.\n$Comp = $ENV:ComputerName\nInvoke-Command -ComputerName $DCs -ScriptBlock {wevtutil epl 'Directory Service' \"\\\\$Using:Comp\\c$\\$ENV:ComputerName-Evil.evtx\"}\n\n# Disable the logging...\n$DCs | Disable-LDAPQueryLogging\n\n# Parse events as desired, perhaps using Ming's script\n    # https://gallery.technet.microsoft.com/scriptcenter/Event-1644-reader-Export-45205268\n    dir C:\\*evil.evtx\n```\n\n## Notes:\n\nThanks to Shay Levy for PSRemoteRegistry. To reduce dependencies, we borrow two functions from that module. PSRemoteRegistry should be in your toolbelt : )\n\nThanks to Mark Morowczynski, Ming Chen, and anyone else who contributed to the great [write-up](http://blogs.technet.com/b/askpfeplat/archive/2015/05/11/how-to-find-expensive-inefficient-and-long-running-ldap-queries-in-active-directory.aspx) on this topic\n\nKeep in mind there are other tools out there. SPA, [AD data collector sets](http://blogs.technet.com/b/askds/archive/2010/06/08/son-of-spa-ad-data-collector-sets-in-win2008-and-beyond.aspx), etc.\n\nStuff that might be fun:\n\n* Collect the logs. wevtutil epl seems to be the fastest.\n* Parse the logs. Maybe leave this to [the script](https://gallery.technet.microsoft.com/scriptcenter/Event-1644-reader-Export-45205268) from Ming Chen. Would be nice to have this analysis without COM though...\n* Add rudimentary tests\n* Clean up code and output\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Framblingcookiemonster%2Fpsldapquerylogging","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Framblingcookiemonster%2Fpsldapquerylogging","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Framblingcookiemonster%2Fpsldapquerylogging/lists"}