Windows OS Hub
  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu
  • Home
  • About

Windows OS Hub

  • Windows Server
    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • SCCM
  • Active Directory
    • Active Directory Domain Services (AD DS)
    • Group Policies
  • Windows Clients
    • Windows 11
    • Windows 10
    • Windows 8
    • Windows 7
    • Windows XP
    • MS Office
    • Outlook
  • Virtualization
    • VMWare
    • Hyper-V
    • KVM
  • PowerShell
  • Exchange
  • Cloud
    • Azure
    • Microsoft 365
    • Office 365
  • Linux
    • CentOS
    • RHEL
    • Ubuntu

 Windows OS Hub / Active Directory / Checking Active Directory Domain Controller Health and Replication

September 21, 2021 Active DirectoryPowerShellWindows Server 2016Windows Server 2019

Checking Active Directory Domain Controller Health and Replication

Active Directory is a reliable, but complex and critical service, and the operability of the whole enterprise network depends on it. A system administrator should constantly check if Active Directory works correctly. In this article, we will go over the main methods of how to check and diagnose the health of your Active Directory domain, domain controllers, and replication.

Contents:
  • How to Check AD Domain Controller Health Using Dcdiag?
  • Checking Active Directory Replication Errors Between DCs

How to Check AD Domain Controller Health Using Dcdiag?

Dcdiag is a basic built-in tool to check Active Directory domain controller health. To quickly check the state of an AD domain controller, use the command below:

dcdiag /s:DC01

The command runs different tests against the specified domain controller and returns a state for each test (Passed/Failed).

Typical tests:

  • Connectivity – checks if the DC is registered in DNS, establishes test LDAP and RPC connections;
  • Advertising – checks roles and services published on the DC;
  • FRSEvent – checks if there are any errors of file replication service (SYSVOL replication errors);
  • FSMOCheck – checks if the DC can connect to KDC, PDC, and Global Catalog server;
  • MachineAccount — checks if the DC account is registered in AD correctly and if the domain trust relationship is correct;
  • NetLogons – checks the logon privileges to allow replication to proceed;
  • Replications – checks the state of replication between domain controllers and if there are any errors;
  • KnowsOfRoleHolders – checks the availability of the domain controllers with FSMO roles;
  • Services – checks if services on the domain controllers are running;
  • Systemlog – checks if there are any errors in the DC logs;
  • Etc.

Testing AD domain controllers health using dcdiag.exe

You can find a full description of all available dcdiag tests here.

Besides default tests, you can run additional domain controller checks:

  • Topology – checks if KCC has generated full topology for all DCs
  • CheckSecurityError
  • CutoffServers – finds a DC that is not replicated since its partner is unavailable
  • DNS – 6 DNS checks are available (/DnsBasic, /DnsForwarders, /DnsDelegation, /DnsDymanicUpdate, /DnsRecordRegistration, /DnsResolveExtName)
  • OutboundSecureChannels
  • VerifyReplicas – checks if the application partitions are replicated correctly
  • VerifyEnterpriseReferences

For example, to check if DNS is working correctly on all domain controllers, use the following command:

dcdiag.exe /s:DC01 /test:dns /e /v

dcdiag dns tests

It will result in a summary table showing test results on how DNS resolves names on all DCs (if it is OK, you will see Pass in every cell). If you see Fail, you need to run this test against the specified DC:

dcdiag.exe /s:DC01 /test:dns /DnsForwarders /v

To get more information from domain controller test results and save it to a text file, use this command:

dcdiag /s:DC01 /v >> c:\ps\dc01_dcdiag_test.log

dcdiag log file

The following PowerShell command displays only a summary information on the performed dcdiag tests:

Dcdiag /s:DC01 | select-string -pattern '\. (.*) \b(passed|failed)\b test (.*)'

Dcdiag summary report powershell script

To get the state of all domain controllers, use:

dcdiag.exe /s:woshub.com /a

If you want to display only the errors you have found, use the /q option:

dcdiag.exe /s:dc01 /q

dcdiag failed test

In my example, the tool has detected some replication errors:

There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems.
......................... DC01 failed test DFSREvent

To make dcdiag automatically fix the Service Principal Names errors for the DC account, use the /fix option:

dcdiag.exe /s:dc01 /fix

Checking Active Directory Replication Errors Between DCs

The built-in repadmin tool is used to check replication in the Active Directory domain.

Here is the basic command to check AD replication:

repadmin /replsum

repadmin /replsummary - checking active directory replication

The tool has returned the current replication status between all DCs. Ideally, the largest delta value should be less than 1 hour (depends on the AD topology and intersite replication frequency settings), and the number of errors = 0. In my example, you can see that one of the latest replication took 14 days, but now it is OK.

To check replication for all DCs in the domain:

repadmin /replsum *

To test intersite replication:

repadmin /showism

To view the replication topology and errors (if any), run this command:

repadmin /showrepl

The command will check the DCs and return the time and date of the last successful replication for each directory partition (last attempt xxxx was successful).

Repadmin /showrepl - replication status. show when the domain controller last attempted to perform inbound replication of Active Directory

To display additional replication info, use this command:

repadmin /showrepl *

To run password replication from a writable domain controller to a read-only domain controller (RODC), the /rodcpwdrepl option is used.

The /replicate option starts the replication of the specified directory partition to a specific DC immediately.

To synchronize a specified DC with all its replication partners, use the command below:

replmon /syncall <nameDC>

To view the replication queue:

repadmin /queue

Ideally, the replication queue should be empty.

Monitoring AD replication queues (repadmin /queue)

Check when the latest backup of the current domain controller was created:

Repadmin /showbackup *

You can also check the replication state using PowerShell. For example, the following command will display all replication errors it finds in the Out-GridView table:

Get-ADReplicationPartnerMetadata -Target * -Partition * | Select-Object Server,Partition,Partner,ConsecutiveReplicationFailures,LastReplicationSuccess,LastRepicationResult | Out-GridView

Get-ADReplicationPartnerMetadata shows an replication partner metadata object for each of its replication partners (domain controllers)

I have uploaded a PowerShell script I often use to check the replication state in AD to my GitHub repository. The script generates an HTML file and can send it by email using the Send-MailMessage cmdlet.

https://github.com/maxbakhub/winposh/blob/main/ADHealthCheck.ps1

powershell script: get replication health summary report

You can also check the state of ADDS basic services on a domain controller using the Get-Service cmdlet:

  • Active Directory Domain Services (ntds)
  • Active Directory Web Services (adws) – all cmdlets from the AD PowerShell module connect to this service
  • DNS (dnscache and dns)
  • Kerberos Key Distribution Center (kdc)
  • Windows Time Service (w32time)
  • NetLogon (netlogon)

Get-Service -name ntds,adws,dns,dnscache,kdc,w32time,netlogon -ComputerName dc01

get adds services states on a domain controller

So, in this article, we have shown basic tools, commands, and PowerShell scripts you can use to diagnose the health of your Active Directory domain. You can use them in all supported Windows Server versions, including the domain controllers running in the Server Core mode.

2 comments
5
Facebook Twitter Google + Pinterest
previous post
Internet Connection Sharing (ICS) Stops Working After Reboot in Windows 10
next post
How to Restore Default Fonts in Windows 10 and 11?

Related Reading

Configure User’s Folder Redirection with Group Policy

February 3, 2023

Join a Windows Computer to an Active Directory...

February 2, 2023

Using Previous Command History in PowerShell Console

January 31, 2023

How to Install the PowerShell Active Directory Module...

January 31, 2023

Finding Duplicate E-mail (SMTP) Addresses in Exchange

January 27, 2023

2 comments

Francesco September 22, 2021 - 8:41 am

Thanks for sharing. Really appreciated. Francesco

Reply
Shen October 7, 2021 - 2:23 am

Thanks for sharing. My reprot have some issue:
The full Active Directory Replication report is available here

Active Directory Replication Problem :
No problem detected

Active Directory Replication OK :
–>here is null<–

Reply

Leave a Comment Cancel Reply

Categories

  • Active Directory
  • Group Policies
  • Exchange Server
  • Microsoft 365
  • Azure
  • Windows 11
  • Windows 10
  • Windows Server 2022
  • Windows Server 2019
  • Windows Server 2016
  • PowerShell
  • VMWare
  • Hyper-V
  • Linux
  • MS Office

Recent Posts

  • Configure User’s Folder Redirection with Group Policy

    February 3, 2023
  • Using Previous Command History in PowerShell Console

    January 31, 2023
  • How to Install the PowerShell Active Directory Module and Manage AD?

    January 31, 2023
  • Finding Duplicate E-mail (SMTP) Addresses in Exchange

    January 27, 2023
  • How to Delete Old User Profiles in Windows?

    January 25, 2023
  • How to Install Free VMware Hypervisor (ESXi)?

    January 24, 2023
  • How to Enable TLS 1.2 on Windows?

    January 18, 2023
  • Allow or Prevent Non-Admin Users from Reboot/Shutdown Windows

    January 17, 2023
  • Fix: Can’t Extend Volume in Windows

    January 12, 2023
  • Wi-Fi (Internet) Disconnects After Sleep or Hibernation on Windows 10/11

    January 11, 2023

Follow us

woshub.com
  • Facebook
  • Twitter
  • RSS
Popular Posts
  • Configure Google Chrome Settings with Group Policy
  • Get-ADUser: Find Active Directory User Info with PowerShell
  • Allow RDP Access to Domain Controller for Non-admin Users
  • How to Find the Source of Account Lockouts in Active Directory?
  • Get-ADComputer: Find Computer Properties in Active Directory with PowerShell
  • How to Disable or Enable USB Drives in Windows using Group Policy?
  • Configuring Proxy Settings on Windows Using Group Policy Preferences
Footer Logo

@2014 - 2023 - Windows OS Hub. All about operating systems for sysadmins


Back To Top