Windows Debugging: Special Traces & Switches
Registry Keys, ETW Traces, Environment Variables & Diagnostic Switches for Deep Error Analysis
Why Windows Has Hidden Diagnostic Modes
Windows ships with extensive built-in diagnostic capabilities that are disabled by default for performance. Enabling them provides deep visibility into authentication failures, network stack behavior, Kerberos ticket issues, NTLM negotiation, TLS handshakes, certificate validation, and much more. This guide covers the most powerful techniques used by Microsoft engineers, enterprise IT, and security researchers.
1. Event Tracing for Windows (ETW)
ETW is the core Windows tracing infrastructure. Nearly every Windows component publishes events via ETW providers. Capture them with logman, wpr, or tracelog.
Key ETW Provider GUIDs
ETW Commands
logman start "KerbTrace" -p {GUID} 0xff 0xff -ets
# Stop:
logman stop "KerbTrace" -ets
# List providers:
logman query providers
# WPR:
wpr -start GeneralProfile -start CPU
2. Netlogon Debug Logging
Netlogon handles domain authentication, secure channel establishment, and DC discovery. Its debug log is invaluable for diagnosing domain join issues, pass-through auth failures, and secure channel problems.
HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters DBFlag = DWORD 0x2080FFFF (full debug) DBFlag = DWORD 0x20000000 (errors only) MaximumLogFileSize = DWORD 0x08000000 (128MB)
Log Location
%SystemRoot%\debug\netlogon.log and netlogon.bak (previous session)
Key Search Terms
Search for NO_TRUST, LOGON_FAILURE, BADPWD to find authentication issues quickly
Reset After Use
Set DBFlag back to 0 after debugging — verbose logging impacts domain controller performance
3. Kerberos Debug Logging & Analysis
Kerberos issues often appear as 0xC000006D or 0xC0000022 errors in event logs. The following registry keys and tools help diagnose ticket failures, KDC communication issues, and SPN mismatches.
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters LogLevel = DWORD 1 (enable) HKLM\SYSTEM\CurrentControlSet\Control\Lsa LsaEventLevel = DWORD 2 (verbose LSA events)
klist Commands
klist purge
klist tgt
klist sessions
klist -li 0x3e7 tgt
Common Kerberos Error Codes
0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN - SPN not found
0x12 KDC_ERR_CLIENT_REVOKED - Account disabled/locked
0x1F KRB_AP_ERR_SKEW - Clock skew > 5 minutes
0x22 KRB_AP_ERR_TKT_EXPIRED - Ticket expired
4. Schannel (TLS/SSL) Verbose Logging
Schannel is Windows built-in TLS/SSL provider. Enabling verbose logging reveals cipher negotiation failures, certificate validation errors, and protocol mismatches.
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL EventLogging = DWORD 7 (verbose: 1=errors, 3=warnings, 7=info) # Check Windows Event Log: Event Viewer > Windows Logs > System > Source: Schannel # TLS Protocol Registry: HKLM\SYSTEM\CCS\Control\SecurityProviders\SCHANNEL\Protocols \TLS 1.2\Client: Enabled = DWORD 1 \TLS 1.0\Client: Enabled = DWORD 0 (disable) # PowerShell cipher suite management: Get-TlsCipherSuite | Format-Table Name, Exchange, Hash
5. NTLM Debugging & Audit
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 NTLMAuditingEnabled = DWORD 1 # Key Security Log Event IDs: # 4776 - NTLM credential validation attempt # 4624 - Successful logon (check LogonType) # 4625 - Failed logon (check SubStatus code) # 4648 - Explicit credential logon
| SubStatus Code | Meaning | Common Cause |
|---|---|---|
| 0xC000006A | Wrong Password | Incorrect credentials entered |
| 0xC0000064 | User Not Found | Username typo or wrong domain |
| 0xC0000234 | Account Locked Out | Too many failed attempts |
| 0xC0000071 | Password Expired | User must change password at next login |
| 0xC0000022 | Access Denied | Insufficient permissions on resource |
6. Network Traces: netsh, pktmon & WFP
netsh Tracing
tracefile=C:\trace.etl
netsh trace stop
netsh trace start scenario=WLAN
netsh trace start scenario=DirectAccess
Packet Monitor (pktmon)
pktmon filter add -p 443
pktmon filter add -p 88
pktmon etl2pcap trace.etl
pktmon start --etw -l real-time
WFP Audit (Windows Filtering Platform)
auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable
# Event IDs: 5157 (blocked), 5156 (allowed), 5031 (service blocked)
7. CAPI2 / Certificate Verification Logging
CAPI2 logging is essential for diagnosing certificate chain validation failures, CRL/OCSP check issues, and smart card authentication problems.
Event Viewer > Apps and Services > Microsoft > Windows > CAPI2 > Operational > Enable Log wevtutil sl Microsoft-Windows-CAPI2/Operational /e:true /ms:102400000 # Key event IDs: # 11 - Certificate chain build FAILURE # 30 - Certificate verification RESULT # 40 - Certificate not yet valid or expired # 70 - CRL retrieval failure # 90 - OCSP response received
8. Sysinternals & Built-In Command Switches
Process Monitor (ProcMon)
Captures file system, registry, network, and process events in real time. Filter by Access Denied, specific processes, or registry paths.
/BackingFile trace.PML
/OpenLog trace.PML (open existing)
auditpol - Fine-Grained Audit
auditpol /set /subcategory:
"File System" /success:enable
auditpol /set /subcategory:
"Logon" /failure:enable
gpresult / RSoP
gpresult /R /user DOMAIN\user
gpupdate /force /sync
rsop.msc (GUI RSoP)
nltest - Netlogon Testing
nltest /sc_reset:DOMAIN
nltest /dsgetdc:DOMAIN
nltest /query (secure channel state)
9. Environment Variables for Debugging
| Variable | Value | Effect |
|---|---|---|
| SSLKEYLOGFILE | C:\ssl-keys.log | Logs TLS session keys for Wireshark decryption (Chrome/Firefox) |
| _NT_SYMBOL_PATH | srv*C:\sym*https://msdl.microsoft.com/download/symbols | Symbol server path for WinDbg, ProcMon, ProcDump |
| WINEDEBUG | +all (extreme), +err (errors) | Debug trace channels (mainly Wine, but useful reference) |
| CRYPT_TRACE_ENABLED | 1 | Enable CNG (Cryptography Next Generation) trace output |
| NODE_TLS_REJECT_UNAUTHORIZED | 0 | Disable TLS cert checking in Node.js (DEBUG ONLY - never in production) |
Quick Reference Card
Auth / Identity Issues
Netlogon DBFlag (0x2080FFFF) + CAPI2 log + Event 4625/4776 SubStatus + klist purge + nltest /sc_verify
TLS / Certificate Issues
Schannel EventLogging=7 + CAPI2 Operational log (Events 11/30/70) + certutil -verify + SSLKEYLOGFILE
Network Connectivity
netsh trace start capture=yes + pktmon filter add + WFP audit Events 5157/5156 + Test-NetConnection -Port
GPO / Policy Issues
gpresult /H + GP Operational log Events 4006/4007 + rsop.msc + secedit /analyze /db secedit.sdb