Active Directory Using the reference
Start here
A quick checklist, what to save while troubleshooting, and a few notes on the commands.
If you’re chasing a particular failure, start with the operation that failed, the machine and account involved, the time and the exact error. Use the search to find a command, symptom or event ID. For a wider look at an environment, this is a useful starting list.
Quick checklist
| Area | What to check |
|---|---|
| DC inventory | Every domain, DC, GC and RODC is accounted for, including unreachable servers. |
| Replication and topology | Failures and delays by naming context; site/subnet coverage and expected convergence. |
| DNS and DC locator | Client/DC resolvers, registrations, zone replica sets and the DC clients actually select. |
| SYSVOL and Group Policy | Shares, file replication, GPO links/filtering, backups and results on affected clients. |
| DC operations | OS/builds, functional levels, roles, time, performance and monitoring. |
| Accounts and security | Account owners, privileged access, service identities, delegation, trusts, LDAP protection and auditing. |
| Recovery | Usable backups, restore tests, DSRM access, Recycle Bin and the dependencies needed to recover. |
| Certificates | Where used, check enrollment, trust, revocation and access to private keys. |
You don’t need to run every check for every problem. Keep track of what you haven’t checked, and test changes that are hard to undo in a representative lab first.
Keep useful notes
- Save the server, domain/partition, object or user, timestamp and original error with the result. Keep raw logs or exports as well as your summary.
- Mark failed, timed-out and uncollected checks. An empty result can mean no matching data, but it can also mean you couldn’t read it.
- Test from the affected client and identity. A successful admin query from your workstation may use a different network or authentication path.
- Capture the useful state before a reset, restart or forced synchronization. Record what you changed, then retry the original operation.
When handing it over, say what you found, what it affects, what you’ve changed or proposed, who’s responsible and how to check the result. A recent backup timestamp isn’t a restore test; a clean replication summary isn’t a measured convergence time.
The DC inventory example keeps failed domains in the report. Ports and logging covers collecting the relevant logs and connection details.
Running the commands
Replace sample names such as contoso.com and dc1.contoso.com with your targets. PowerShell examples assume a Windows machine with the relevant RSAT modules. A common setup is:
Import-Module ActiveDirectory
$dc = 'dc1.contoso.com'
$root = Get-ADRootDSE -Server $dc
$base = $root.defaultNamingContext
Each note has its own setup. Commands that change directory state or local settings are labelled. Check the target and required rights; use -WhatIf where supported. It doesn’t apply automatically to tools such as Repadmin or Ntdsutil.
Most Get-AD* commands use ADWS on 9389, while LDP uses LDAP directly. If one works and the other fails, check that extra service and authentication path. Microsoft’s instance-selection reference explains the port behavior.