Active Directory

A quick checklist, what to save while troubleshooting, and a few notes on the commands.

Naming contexts, the global catalog, ESE, phantoms, and the difference between an object GUID and a local database tag.

Search bases, scopes, filters, paging, range retrieval, query policy and ways to find an expensive search.

Read class definitions, inspect indexes and the partial attribute set, and map forward links to their backlinks.

Add a custom attribute to computer accounts, work through the LDIF imports and check that the application can use it.

Create a linked pair, let AD maintain the reverse view and check the result from both objects.

Transaction logs, white space, garbage collection, object counts and investigating CNF names without deleting the wrong object.

Find the right application directory, distinguish its identities and replication from AD DS, and check bind and backup assumptions.

Work out which connection is failing, check LDAP, ADWS and RPC, and collect the logs you need.

Choose between notifications, DirSync and USN polling, and design checkpoints that survive retries, moves, deletions and restores.

Connect a slow application request to event 1644, query statistics, indexing and the actual cost of returning the result.

Resolve server and site policy assignments, distinguish LDAP limits from client and ADWS limits, and investigate truncation without weakening every DC.

Diagnose missing attributes, filtered-out objects, group membership differences and application-partition searches across full and partial replicas.

Find the failing destination, partition, partner, and dependency before changing the topology.

USNs, invocation IDs, high-watermarks, linked values, and the evidence behind an attribute change.

Recognize an outdated replica, distinguish the event IDs, and investigate without bypassing protection.

Check site membership, site links, KCC connections, ISTGs, and bridgehead assumptions.

Separate host lookup, service discovery, site selection, and the DNS configuration on the machine doing the lookup.

Understand timestamps and intervals before allowing a DNS server to remove stale records.

Separate DNS and RPC failures, Kerberos identity problems, replication permissions, topology changes, and canceled requests.

Follow a partition from site-link design to connection objects and local replication agreements, including disabled translation and failover constraints.

Time a directory change and a SYSVOL file separately, keep failed queries in the results, and distinguish arrival time from last-success age.

Locate the zone actually loaded, distinguish AD replication from zone transfer, and trace the registrar, scope and startup dependencies behind missing records.

Check the shares, folder state, backlog, and whether the required files actually arrived.

Configuration, RDC, staging, conflicts, and the distinction between file replication and SMB access.

Historical FRS notes and the state checks that matter when moving SYSVOL to DFSR.

Work from the affected client through scope, filters, precedence, loopback, and the responsible extension.

Export policy reports, preserve backups, inspect the Central Store, and collect diagnostics before cleanup.

Separate referral failures, unexpected targets, and failures connecting to the actual SMB share.

Choose the right recovery scope, preserve the correct files, and follow disable, replicate, poll, and initialization events in order.

Correlate one processing instance, investigate GPO read access and gpt.ini failures, and distinguish filtering from a failing extension.

Read FRS journals, change orders, partner state, morphed folders, and recovery evidence without confusing them with DFSR.

Compare baseline settings with your GPOs, check what reached the client, and test the change and its reversal.

Follow deployment, evaluation and reporting separately; distinguish unknown, inapplicable and failed checks from a real configuration mismatch.

Follow the ticket exchange, inspect the right logon session, and separate authentication from access checks.

Find an SPN, establish which identity owns the service, and diagnose aliases and duplicate registrations.

Trace the secure-channel validation path and investigate Netlogon queues before changing concurrency settings.

Establish trust direction, inspect routing and filtering, and distinguish permission to authenticate from resource access.

Read logon attributes correctly, find unusual account flags, and create review lists without deleting accounts.

Identify the effective policy, correlate the lockout with authentication failures, and find the source of repeated credentials.

Separate Kerberos ticket size from Windows access-token limits and inspect the memberships behind an access decision.

Inventory unconstrained, constrained, and resource-based delegation and inspect who can change those relationships.

Decode encryption numbers, distinguish ticket and session keys, and diagnose AES and RC4 dependencies on current DCs.

Locate a delegation failure in first-hop authentication, S4U evidence, back-end ticket issuance, or the resource's access check.

Separate credentials, protocol exchanges, security contexts and access tokens when the same account works in one process but fails in another.

Identify the bind and transport, interpret Server 2025 policy precedence, and test the protection the application actually negotiates.

Review powerful memberships, Protected Users, LAPS coverage, signing requirements, auditing, and krbtgt rotation evidence.

Locate the failing certificate operation, inspect the correct store and key, then follow chain, enrollment, mapping or CA recovery evidence.

Inspect password replication policy, distinguish allowed from cached credentials, and test the actual branch-office dependencies.

Find the certificate and chain element that failed, test the actual publication URLs, and separate missing revocation evidence from a revoked certificate.

Separate the AD template, CA issuance list, requester permissions and enrollment state, then test issuance and renewal with the real identity.

Preserve the CA identity, keys, database, configuration and publication dependencies, then prove recovery from a relying client.

Diagnose certificate-to-account binding after KB5014754, distinguish KDC mapping from TLS trust, and repair issuance or an explicit mapping.

Enable bounded diagnostic logging, interpret signing and CBT events, and turn client addresses into an application remediation list.

Distinguish recovery of a file's encryption key from recovery of the user's private key, and establish what was protected before a key was lost.

Trace policy discovery, requester identity, CA submission, template synchronization and certificate use across forest and network boundaries.

Match the issuer key, response signer and revocation data, then distinguish transport success, cached answers and actual OCSP validation.

Follow HTTPS policy discovery, advertised enrollment endpoints, authentication, CA submission and renewal, then verify endpoint protection independently.

Find the DCs and role holders, check whether they're ready to serve clients, and narrow down a slow or unhealthy DC.

Follow the time-source chain, compare offsets and find out why Windows accepted or rejected a correction.

Check what the backups cover and make sure you can recover them when AD itself is unavailable.

Inspect retention, find the exact deleted object, restore its parent first and understand what the Recycle Bin cannot recover.

Open a historical directory through DSAMAIN and compare its objects with the live directory.

Understand what VM-GenerationID protects during rollback, what it can't recover, and which hosting dependencies can stop recovery.

Check the member's DC and machine-account state before repairing its secure channel.

Check what a missing role actually affects, choose transfer or seizure, and test the new owner's readiness.

Find the failed join stage, check account-reuse restrictions, and understand what offline provisioning changes on each side.

The distinctions that matter before moving accounts, translating permissions, or replacing domain controllers.

Check gMSA password generation, who can retrieve the password, and whether the service host and application are ready to use it.

Choose boundaries for isolation, replication and administration, then test what the branch actually needs during an outage.

Follow a slow request through CPU, memory, storage and authentication queues to find where it waits.

Work out what happens to DC load at peak times, after a restart and when a host or site fails.

Check what actually installed, patch a pilot DC and test the services clients depend on before moving to the next batch.

Find out whether account creation is blocked by a local RID pool, the RID master or the domain's allocation ceiling.

Find where promotion failed, understand what IFM supplies, and remove a DC without leaving its directory state behind.

Work out whether you're repairing a server, replicated directory data or exposed credentials, and where the good state will come from.