Apr 28, 2004

FileMon, RegMon from www.sysinternals.com to monitor which file(s), registry is being accessed
if want to know which AD object is being accessed, use netmon

also fport.exe to monitor TCP/IP ports