Active Directory is a reliable, but complex and critical service, and the operability of the whole enterprise network depends on it. A system administrator should constantly check if Active Directory works correctly. In this article, we will go over the main methods of how to check and diagnose the health of your Active Directory domain, domain controllers, and replication.

How to Check AD Domain Controller Health Using Dcdiag?

Dcdiag is a basic built-in tool to check Active Directory domain controller health. To quickly check the state of an AD domain controller, use the command below:

dcdiag /s:DC01

The command runs different tests against the specified domain controller and returns a state for each test (Passed/Failed).

Typical tests:

• Connectivity – checks if the DC is registered in DNS, establishes test LDAP and RPC connections;
• Advertising – checks roles and services published on the DC;
• FRSEvent – checks if there are any errors of file replication service (SYSVOL replication errors);
• FSMOCheck – checks if the DC can connect to KDC, PDC, and Global Catalog server;
• MachineAccount — checks if the DC account is registered in AD correctly and if the domain trust relationship is correct;
• NetLogons – checks the logon privileges to allow replication to proceed;
• Replications – checks the state of replication between domain controllers and if there are any errors;
• KnowsOfRoleHolders – checks the availability of the domain controllers with FSMO roles;
• Services – checks if services on the domain controllers are running;
• Systemlog – checks if there are any errors in the DC logs;
• Etc.

Besides default tests, you can run additional domain controller checks:

• Topology – checks if KCC has generated full topology for all DCs
• CheckSecurityError
• CutoffServers – finds a DC that is not replicated since its partner is unavailable
• DNS – 6 DNS checks are available (/DnsBasic, /DnsForwarders, /DnsDelegation, /DnsDymanicUpdate, /DnsRecordRegistration, /DnsResolveExtName)
• OutboundSecureChannels
• VerifyReplicas – checks if the application partitions are replicated correctly
• VerifyEnterpriseReferences

For example, to check if DNS is working correctly on all domain controllers, use the following command:

dcdiag.exe /s:DC01 /test:dns /e /v

It will result in a summary table showing test results on how DNS resolves names on all DCs (if it is OK, you will see Pass in every cell). If you see Fail, you need to run this test against the specified DC:

dcdiag.exe /s:DC01 /test:dns /DnsForwarders /v

To get more information from domain controller test results and save it to a text file, use this command:

dcdiag /s:DC01 /v >> c:\ps\dc01_dcdiag_test.log

To get the state of all domain controllers, use:

dcdiag.exe /s:woshub.com /a

If you want to display only the errors you have found, use the /q option:

dcdiag.exe /s:dc01 /q

In my example, the tool has detected some replication errors:

There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems.
......................... DC01 failed test DFSREvent

To make dcdiag automatically fix the Service Principal Names errors for the DC account, use the /fix option:

dcdiag.exe /s:dc01 /fix

Checking Active Directory Replication Errors Between DCs

The built-in repadmin tool is used to check replication in the Active Directory domain.