Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
  5. Logs
  6. Directory Service.evtx
LogRisk: Caution
  • Windows Server

Directory Service.evtx C:\Windows\System32\winevt\Logs\Directory Service.evtx

Directory Service.evtx: the Active Directory Domain Services log of a domain controller (startup, replication, database, LDAP binds).

Updated on By AltF4 Formation

What it’s for

Directory Service.evtx is the AD DS log on a domain controller, and it exists nowhere else. It is the first place to open for a directory service that will not start, replication that has stopped, an ntds.dit database in trouble, or insecure LDAP binds.

What it contains

  • Directory service startup and shutdown (events 1000 and 1004).
  • Replication and database warnings and errors: 1311 (the KCC detects a topology problem), 2042 (too long since the last replication, beyond the tombstone lifetime), 1394 (database writes unblocked again after a full disk).
  • LDAP security: 2886 (LDAP signing not required), 2887 (daily summary of binds without signing or encryption) and 2889 (the detail, client by client).
  • Detailed diagnostic events, if the NTDS diagnostics level was raised.

Event 2889 only appears when the 16 LDAP Interface Events value under HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics is set to 2. High levels generate a lot of events, so set it back to 0 once the investigation is over.

Risks and best practices

  • It documents the health of the directory. Export it before any purge.
  • Forward it with the Security, DNS Server and DFS Replication logs of every domain controller.
  • Events name accounts, machines and objects, so treat copies as sensitive.
  • A log that fills quickly points to a problem, such as failing replication or a misconfigured client. Fix the cause rather than raising the size.

Useful commands

Fenêtre de terminal
# Latest errors and warnings in the log (as administrator)
Get-WinEvent -FilterHashtable @{LogName='Directory Service'; Level=2,3} -MaxEvents 30 |
    Select-Object TimeCreated, Id, ProviderName, Message


# LDAP binds without signing: 2887 (summary) and 2889 (detail)
Get-WinEvent -FilterHashtable @{LogName='Directory Service'; Id=2887,2889} -MaxEvents 20


# Turn on per-bind detail (2889); set back to 0 afterwards
Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics' -Name '16 LDAP Interface Events' -Value 2


# Log configuration
wevtutil gl "Directory Service"

Format

Binary XML file (.evtx), managed by the Windows Event Log service.

Rotation and archiving

The maximum size and the behavior when full are set in the log properties or through Group Policy. For a snapshot: wevtutil epl "Directory Service" C:\Temp\DirectoryService.evtx.

How to read it

Event Viewer > Applications and Services Logs > Directory Service. Filter by source (for example ActiveDirectory_DomainService) and by level. For an exported file, use Get-WinEvent -Path.

Report a mistake