Windows OS Hub
  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux
  • Home
  • About

Windows OS Hub

  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux

 Windows OS Hub / Active Directory / Checking Active Directory Domain Controller Health and Replication

May 15, 2025

Checking Active Directory Domain Controller Health and Replication

Active Directory is a reliable yet critical service, and the functionality of the entire enterprise network depends on its proper operation. The proper functioning of Active Directory requires constant monitoring by the system administrator. This article describes how to use the dcdiag, repadmin, PowerShell, and other built-in tools to check and diagnose the health of your Active Directory domain, domain controllers, and replication status.

Contents:
  • How to Check AD Domain Controller Health Using Dcdiag
  • Checking Active Directory Replication Health
  • Check Basic Domain Controller Services Health

How to Check AD Domain Controller Health Using Dcdiag

Dcdiag (Domain Controller Diagnostic Tool) is a basic built-in tool for checking the health of Active Directory domain controllers. To quickly check the state of a specific AD domain controller, use the command:

dcdiag /s:DC01

The command performs various tests against the specified domain controller and returns the status for each test (Passed | Failed).

Typical tests:

  • Connectivity – checks if the DC is registered in DNS, tests LDAP and RPC connectivity
  • Advertising – checks the roles and services published on the DC
  • FRSEvent – checks for errors in the file replication service and SYSVOL replication errors
  • FSMOCheck – verifies that the DC can connect to the KDC, PDC, and Global Catalog server
  • MachineAccount — verifies that the DC account is correctly registered in AD and that the domain trust relationship is correct
  • NetLogons – checks the logon privileges to allow replication to proceed
  • Replications – checks the status of the replication between the domain controllers and whether there are any errors
  • KnowsOfRoleHolders – checks the availability of the domain controllers with FSMO roles
  • Services – checks that the required services are running on the domain controllers
  • Systemlog – checks for errors in the DC logs
  • Etc.

Testing AD domain controllers health using dcdiag.exe

For a complete description of all available dcdiag tests, click here.

In addition to the standard checks performed by default, there are additional checks you can run against the domain controller:

  • Topology – checks if KCC has generated a full topology for all DCs
  • CheckSecurityError
  • CutoffServers – finds a DC that is not replicated because its partner is unavailable
  • DNS – six DNS checks are available (
  • /DnsBasic, /DnsForwarders, /DnsDelegation, /DnsDymanicUpdate, /DnsRecordRegistration, /DnsResolveExtName)
  • OutboundSecureChannels
  • VerifyReplicas – checks if the application partitions are replicated correctly
  • VerifyEnterpriseReferences

For example, if you want to verify that DNS is working correctly on all of your domain controllers, use the command:

dcdiag.exe /s:DC01 /test:dns /e /v

dcdiag dns tests

It will result in a summary table showing test results on how DNS resolves names on all DCs (if it is OK, you will see Pass in each cell).  If you see Fail, you need to run this test against the problem DC:

dcdiag.exe /s:DC01 /test:dns /DnsForwarders /v

Get detailed information about the domain controller test results and save the output to a text file:

dcdiag /s:DC01 /v >> c:\ps\dc01_dcdiag_test.log

dcdiag log file

To view only summary information about the dcdiag tests that were performed (whether they Passed or Failed), use the following PowerShell command:

Dcdiag /s:DC01 | select-string -pattern '\. (.*) \b(passed|failed)\b test (.*)'

Dcdiag summary report powershell script

Query the status of all domain controllers:

dcdiag.exe /s:woshub.com /a

To prevent unnecessary information about successful checks from cluttering the dcdiag output, you can add the /q parameter to query the status of domain controllers and AD, displaying only errors that require administrator attention:

dcdiag /q /e /v

dcdiag /q - show only domain controller errors

Or get errors for a specific DC:

dcdiag.exe /s:dc01 /q

dcdiag failed test

The dcdiag command has a /fix option that allows automatic fixing of trivial errors in AD on a specific DC:

dcdiag.exe /s:dc01 /fix

On all domain controllers:

dcdiag /e /fix

Checking Active Directory Replication Health

The built-in repadmin utility is used to check the replication status between Active Directory domain controllers.  The basic command for checking the status of both inbound and outbound replication on a DC is:

repadmin /replsum

repadmin /replsummary - checking active directory replication

The tool returns the current status of replicating between all DCs. Ideally, the largest delta value should be less than 1 hour (depends on the AD topology and inter-site replication frequency settings), and the number of replication fails should be 0. In my example, you can see that one of the last replications took 14 days, but now it is OK.

To check replication for all DCs in the domain:

repadmin /replsum *

Verify inter-site replication:

repadmin /showism

To view the replication topology and errors (if any), run this command:

repadmin /showrepl

The command checks the DC and returns the time and date of the last successful replication for each directory partition (last attempt xxxx was successful).

Repadmin /showrepl - replication status. show when the domain controller last attempted to perform inbound replication of Active Directory

 For verbose replication status information, use this command:

repadmin /showrepl *

To initiate password replication from a writable domain controller (RWDC) to a read-only domain controller (RODC), use the /rodcpwdrepl option.

The /replicate option forces replication of the specified directory partition to a specific DC.

Use the following command to force a specified domain controller DC to synchronize with all of its replication partners (performs pull replication, which means that the domain controller pulls changes from its replication partners):

repadmin /syncall

Add the /AdeP switch to push changes from the domain controller outward to all other domain controllers:

repadmin /syncall /AdeP

To view the replication queue:

repadmin /queue

Ideally, the replication queue should be empty.

Monitoring AD replication queues (repadmin /queue)

Check when the last backup of the current domain controller was created:

Repadmin /showbackup *

There are also several PowerShell cmdlets that you can use to check the status of replication in AD.

Get a list of DCs in a domain:

Get-ADDomainController

List replication errors on the specified DCs:

Get-ADReplicationFailure -Target DC1,DC2

View AD replication errors in a site ( -Scope Site ) or domain ( -Scope Domain ):

Get-ADReplicationFailure -scope site -target Berlin| FT Server, LastError, Partner-Auto
Get-ADReplicationFailure -Target woshub.com -Scope Domain

Get the current DC’s replication partner list:

Get-ADReplicationConnection -Filter *

To force replication, use the Sync-ADObject cmdlet.

For example, the following command will display all replication errors detected in the Out-GridView table:

Get-ADReplicationPartnerMetadata -Target * -Partition * | Select-Object Server,Partition,Partner,ConsecutiveReplicationFailures,LastReplicationSuccess,LastRepicationResult | Out-GridView

Get-ADReplicationPartnerMetadata shows an replication partner metadata object for each of its replication partners (domain controllers)

I have uploaded a PowerShell script that I often use to check the replication status in AD to my GitHub repository. The script generates an HTML file and can send it by email using the Send-MailMessage cmdlet.

https://github.com/maxbakhub/winposh/blob/main/ADHealthCheck.ps1

powershell script: get replication health summary report

  • This script is for the English version of Windows Server.
  • To periodically check the status of domain controllers, you can add a PowerShell script to the Task Scheduler.

Check Basic Domain Controller Services Health

Let’s look at how to check the status of other basic domain controller services.

To get the status of the ADDS services, use the Get-Service cmdlet:

Get-Service -name ntds,adws,dns,dnscache,kdc,w32time,netlogon

You can also check the state of ADDS basic services on a domain controller using the Get-Service cmdlet:

  • Active Directory Domain Services (ntds)
  • Active Directory Web Services (adws) – all cmdlets from the AD PowerShell module connect to this service
  • DNS (dnscache and dns)
  • Kerberos Key Distribution Center (kdc)
  • Windows Time Service (w32time)
  • NetLogon (netlogon)

get adds services states on a domain controller

Also, check that the SYSVOL and NETLOGON shared folders are published on the DC:

net share

To check the health of the GPO infrastructure on domain controllers, use the Group Policy Management graphical console ( gpmc.msc ). Run GPMC, select the domain root, and click the Detect Now button on the Status tab.

check gpo health

This compares the GPO information in AD with the SYSVOL information on each domain controller.

Next, be sure to check the time synchronization on the domain controllers using the command:

w32tm /monitor

The time difference between the PDC (the primary time source in the domain) and other DCs should be around 0 (NTP offset). If not, check the NTP time synchronization in Active Directory.

w32tm /monitor check ntp time sync on dc

So, in this article, we have covered basic tools, commands, and PowerShell scripts that you can use to diagnose the health of your Active Directory domain. You can use them in all supported versions of Windows Server, including domain controllers running in Server Core mode.

3 comments
9
Facebook Twitter Google + Pinterest
Active DirectoryPowerShellWindows Server 2022
previous post
Internet Connection Sharing (ICS) Stops Working After Reboot in Windows 10
next post
How to Restore Default Fonts in Windows 10 and 11

Related Reading

How to Refresh (Update) Group Policy Settings on...

August 13, 2024

Repairing the Domain Trust Relationship Between Workstation and...

May 16, 2024

Updating Group Policy Administrative Templates (ADMX)

January 24, 2025

Display System Info on Desktop with BGInfo

February 6, 2025

Configuring Password Policy in Active Directory Domain

March 12, 2024

Troubleshooting: Group Policy (GPO) Not Being Applied to...

March 15, 2024

Using Windows Update Delivery Optimization in Local Networks

March 15, 2024

Time-Based (Temporary) Group Membership in Active Directory

March 15, 2024

3 comments

Francesco September 22, 2021 - 8:41 am

Thanks for sharing. Really appreciated. Francesco

Reply
Shen October 7, 2021 - 2:23 am

Thanks for sharing. My reprot have some issue:
The full Active Directory Replication report is available here

Active Directory Replication Problem :
No problem detected

Active Directory Replication OK :
–>here is null<–

Reply
Tom April 19, 2023 - 6:18 am

To quickly get the replication status for all DCs on the specified site:
Get-ADReplicationFailure -scope site -target Madrid | FT Server, LastError, Partner-Auto

Or for all domain controllers in the domain or in the forest (-Scope Forest):
Get-ADReplicationFailure -Target “woshub.com” -Scope Domain

Get-ADReplicationConnection cmdlet is used to display information about the replication partners for the current domain controller.
Get-ADReplicationConnection -Filter *

To force synchronization of the specific object between domain controllers, Sync-ADObject cmdlet is used
Get-ADDomainController -filter * | foreach {Sync-ADObject -Object “cn=John Silvia,cn=Users,dc=woshub,dc=com” -source DC1 -Destination $_.hostname}
Get the replication status of a certain object:
Get-ADReplicationAttributeMetadata -Object “CN=Maggie Skosana,OU=Users,DC=woshub,DC=com” -Server DC1

Get-ADReplicationUpToDatenessVectorTable cmdlet allows to get the list of USN values for replication partners:

Get-ADReplicationUpToDatenessVectorTable * | ft Partner,Server,UsnFilter

Reply

Leave a Comment Cancel Reply

join us telegram channel https://t.me/woshub
Join WindowsHub Telegram channel to get the latest updates!

Recent Posts

  • Map a Network Drive over SSH (SSHFS) in Windows

    May 13, 2025
  • Configure NTP Time Source for Active Directory Domain

    May 6, 2025
  • Cannot Install Network Adapter Drivers on Windows Server

    April 29, 2025
  • Change BIOS from Legacy to UEFI without Reinstalling Windows

    April 21, 2025
  • How to Prefer IPv4 over IPv6 in Windows Networks

    April 9, 2025
  • Load Drivers from WinPE or Recovery CMD

    March 26, 2025
  • How to Block Common (Weak) Passwords in Active Directory

    March 25, 2025
  • Fix: The referenced assembly could not be found error (0x80073701) on Windows

    March 17, 2025
  • Exclude a Specific User or Computer from Group Policy

    March 12, 2025
  • AD Domain Join: Computer Account Re-use Blocked

    March 11, 2025

Follow us

  • Facebook
  • Twitter
  • Telegram
Popular Posts
  • Configure Google Chrome Settings with Group Policy
  • Get-ADUser: Find Active Directory User Info with PowerShell
  • How to Disable or Enable USB Drives in Windows using Group Policy
  • How to Find the Source of Account Lockouts in Active Directory
  • Get-ADComputer: Find Computer Properties in Active Directory with PowerShell
  • Configuring Proxy Settings on Windows Using Group Policy Preferences
  • Adding Domain Users to the Local Administrators Group in Windows
Footer Logo

@2014 - 2024 - Windows OS Hub. All about operating systems for sysadmins


Back To Top