Active Directory Health Check

Weekly or bi-weekly Active Directory Health Checks are an important part of a Microsoft SysAdmin’s responsibility. Busy or inexperienced SysAdmin’s often overlook some of the important Health Check steps or don’t do them at all. Taking the time to routinely review and assess your Microsoft Active Directory is the difference between a proactive SysAdmin and a reactive SysAdmin.

First of all, monitoring the Windows Event Viewer is a must. Take the time to check through all of the Event Log queues including the Application, Security and System log. On Domain Controllers the DFS Replication, Directory Service and DNS Server logs should also be reviewed. Leverage the sort and error fields to filter out the information you don’t need to see.

Next, run command line diagnostics and pipe the results to a text document for in-depth review. This allows you to analyze the results in detail and compare results after you’ve fixed any issues you identify. Its also much easier to read the logs in a NotePad++ window and search for events then trying to dig through command line output.

The following reports can be ran from the Windows command prompt:

DC Diag

This report will identify issues with domain controllers and any services associated with them:

C:\>dcdiag.exe /v >> c:\pre_dcdiag.txt

DNS Diag

This test will assess the health of DNS services, records and entries for the entire Enterprise.

C:\>dcdiag.exe /Dnsall >> c:\pre_dnsdiag.txt

Net Diag

Net Diag will identify problems with network components and configuration. Note that this tool has been depreciated in Windows 2008 but can still be used in compatibility mode.

C:\>netdiag.exe /v >> c:\pre_netdiag.txt

Netsh DHCP

This command, ran within netsh, will show the status of the local DHCP server.

C:\>netsh dhcp show server >> c:\pre_dhcp.txt

RepAdmin

This command will show the status of inter-domain replication and wether or not it is successful. Be aware that DC’s holding the global catalog role will return additional information:

C:\>repadmin /showreps >> c:\pre_rep_partners.txt

A more exhaustive report can be ran using:

C:\>repadmin /replsum /errorsonly >> c:\pre_repadmin_err.txt

Post-Reporting

Once you have ran your reports, analyze them then re-run the checks and pipe the output to post_ rather than pre_, for example:

C:\>dcdiag.exe /v >> c:\post_dcdiag.txt

Don’t forget about you member servers. Whilst your Domain Controllers, Global Catalog and Operations Master (FSMO) role holders are the heart of your Active Directory domain, member servers provide services and information to your user. At a minimum you should be running a AD Health Check once per week and a Event Log assessment on your Member Servers at least once a fortnight.

AD Health Check Script

I have put together a simple Active Directory Health Check script which is available for download here. Copy this into your Domain Controller and run it then assess the report and output. For a security standpoint, I always recommend you assess the security of the script before running it at random 🙂