Winternals Software's Insight for Active Directory Detects Anomalies

Easy Installation

I tested the product on a modestly equipped network, using several servers and workstations running across a 100Base-T switched segment. I easily installed Insight on a host machine running Windows XP Pro and connected to a Windows 2000 Server configured as an AD domain controller. After being prompted for login info, I had Insight running.

Unfortunately, the licensing scheme was kludgy, requiring me to choose between cutting and pasting the licensing key into a pop-up window and browsing my drive for a separate licensing key file. There was no option for icon desktop or toolbar placement. The product simply installed itself into an unassuming program group.

Examination of the post-installation system changes showed that the main executable took up a scant 1 MB. No hanky-panky occurred in the system registry or the all-important .INI files.

Insight's interface is refreshingly uncluttered and simple to use. You can connect to a local or remote machine if you have domain administrator-level rights. In addition, you can open as many windows as your license allows to monitor AD services.

Functioning as a virtual keystroke logger for some imaginary LDAP typist, Insight trapped all internal AD transactions generated.

Insight's Event List History Depth is set to default at 50,000 lines and functions as a kind of rolling window once the List History is full, retaining only the last incremented number of entries.

Reporting & FilteringInsight really shines in reporting. Options range from the most comprehensive reporting, which provides an almost overwhelming amount of information, to highly filtered information based on your settings. You can obtain reports in log format or HTML.

After setting the filters for timing issues, apps and service failures, I deliberately mucked up a group policy to create an imaginary conflict. Insight detected the problem almost immediately and advised me of it in the primary viewer window.

Network utilization remained low throughout testing. NIC usage between the observer workstation and the Windows 2000 box routinely stayed below a svelte 0.05 percent during most activities. The same was true for CPU usage. I easily monitored many remote systems from a modestly configured workstation without taxing the CPU or network.

Winternals says Insight is particularly useful in an environment migrating from, say, Windows 2000 to 2003. I couldn't agree more.

John Shireley is the communications director for Helios Software. Write to him at [email protected].0