Public/Disable-LDAPQueryLogging.ps1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
Function Disable-LDAPQueryLogging {
<#
    .SYNOPSIS
        Disable diagnostic LDAP query logging on a domain controller
 
    .DESCRIPTION
        Disable diagnostic LDAP query logging on a domain controller
 
        We set the Field Engineering data to 0, and set a few parameters back to the defaults
 
    .FUNCTIONALITY
        Active Directory
 
    .PARAMETER ComputerName
        One or more domain controllers
 
    .PARAMETER ExpensiveThreshold
        Set the 'Expensive Search Results Threshold' value's data to this. Default: 10,000
 
    .PARAMETER InefficientThreshold
        Set the 'Inefficient Search Results Threshold' value's data to this. Default: 1,000
 
    .PARAMETER SearchTimeThreshold
        Set the 'Search Time Threshold (msecs)' value's data to this. Default: 30,000
 
    .EXAMPLE
        Disable-LDAPQueryLogging -ComputerName DS1
 
        # Disable diagnostic logging on DS1
 
    .LINK
        https://github.com/RamblingCookieMonster/PSLDAPQueryLogging
 
    .LINK
        Test-LDAPQueryLoggingPrerequisites
 
    .LINK
        Enable-LDAPQueryLogging
 
    .LINK
        Get-LDAPQueryLogging
 
    .LINK
        http://blogs.technet.com/b/askpfeplat/archive/2015/05/11/how-to-find-expensive-inefficient-and-long-running-ldap-queries-in-active-directory.aspx
    #>
    
    [cmdletbinding()]
    param (
        [parameter(ValueFromPipeline=$true,
                   ValueFromPipelineByPropertyName=$true)]
        [string[]]$ComputerName = $env:COMPUTERNAME,

        [validaterange(0,2147483647)]
        [int]$ExpensiveThreshold = 10000,

        [validaterange(0,2147483647)]
        [int]$InefficientThreshold = 1000,

        [validaterange(0,2147483647)]
        [int]$SearchTimeThreshold = 30000
    )
    process
    {
        foreach($Computer in $ComputerName)
        {
            # Disable
            Try
            {
                Set-RegDWord -ComputerName $Computer -Hive LocalMachine -Key 'System\CurrentControlSet\Services\NTDS\Diagnostics' -Value '15 Field Engineering' -data 0 -force -Confirm:$False
            }
            Catch
            {
                Write-Error "Failed to disable logging on '$Computer'"
                Throw $_
            
            }
        
            # Set default thresholds
            Set-RegDWord -ComputerName $Computer -Hive LocalMachine -Key 'SYSTEM\CurrentControlSet\Services\NTDS\Parameters' -Value 'Expensive Search Results Threshold' -data $ExpensiveThreshold -force -Confirm:$False
            Set-RegDWord -ComputerName $Computer -Hive LocalMachine -Key 'SYSTEM\CurrentControlSet\Services\NTDS\Parameters' -Value 'Inefficient Search Results Threshold' -data $InefficientThreshold -force -Confirm:$False
            Set-RegDWord -ComputerName $Computer -Hive LocalMachine -Key 'SYSTEM\CurrentControlSet\Services\NTDS\Parameters' -Value 'Search Time Threshold (msecs)' -data $SearchTimeThreshold -force -Confirm:$False
        }
    }
}