Enabling ETW tracing for NTLM issues 2


ETW (Event Tracing for WIndows) is said to be powerful by Microsoft, but the setup of the various providers can be tedious because the documentation often lacks examples for the specific provider you desesperately need.

Here is a script to start recording NTLM authentication traces on a Domain Controller, in the existing directory of your choice


Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

2 thoughts on “Enabling ETW tracing for NTLM issues

  • Charlie

    Hello
    I am using the script and imported the results into event view for windows

    However although I get lots of events with Event ID 0 there is no data in any of the events

    For example I ran it on the domain controller then from a non domain joined computer I mapped tried to map a drive to e.g. \\10.10.10.10\c$ (where the IP address is the IP address of the DC) using an incorrect username and password combination so I know it would error
    However then I stopped the trace and looked a the log I just saw lots of event ID 0 with no data in any of them, that am I doing wrong please

    • Dimitri Post author

      Since the code was written on Windows 2008R2, you may want to check if the providers are still available under the same GUID.
      Do the GUIDs in the batch file show up when you run “logman query providers”.