JSI Tip 2886. How can I enable diagnostic event logging for Active Directory services?

Diagnostic logging of Active Directory services is available, but turned off by default, as it could quickly fill your event log.

If you are having problems related to any of the following services, you can configure larger event logs, by selecting the event log and right-clicking Properties:

1 Knowledge Consistency Checker (KCC)
2 Security Events
3 ExDS Interface Events
4 MAPI Interface Events
5 Replication Events
6 Garbage Collection
7 Internal Configuration
8 Directory Access
9 Internal Processing
10 Performance Counters
11 Initialization/Termination
12 Service Control
13 Name Resolution
14 Backup
15 Field Engineering
16 LDAP Interface Events
17 Setup
18 Global Catalog
19 Inter-site Messaging

To enable the diagnostic logging, use Regedt32 to navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics

Double-click the Value Name that corresponds to the service you wish to log. In the Dword Editor, change the data value. The valid data values are:

0 (None): This default setting only logs critical events and error events.
1 (Minimum): One message per major task.
2 (Basic)
3 (Extensive): Log the steps to complete a task.
4 (Verbose)
5 (Internal:): Log everything.

NOTE: See tip 2519.

NOTE: See What Active Directory diagnostic event logging categories have been added in Windows Server 2003?