AD- Health Check

Question

Hi,

We have separated our network into two domains (forests) and have demoted more than 30 domain controllers. Now, we want to check the health status and ensure everything is functioning correctly.

Could you please guide us on what aspects we need to check and validate from the Active Directory side, such as metadata cleanup and other necessary steps? Your response would be really helpful.

Thanks!

Answer 1

Hello Khushboo Kumari,

Thank you for posting in Q&A forum.

You can try to check the information below:
1.Please run Dcdiag /v >C:%computername%_diag.txt on each Domain Controller.

Or please run Dcdiag /v /e >C:\log%computername%_diag.txt on any one Domain Controller.

/e Tests all the servers in the enterprise. This overrides /a.

https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dcdiag

2.Please check the SYSVOL and Netlogon folders are shared on each Domain Controller.

3.Please check the AD replication in the forest. Run commands below on PDC.

repadmin /showrepl >C:\rep1.txt

repadmin /replsum >C:\rep2.txt

repadmin /showrepl * /csv >c:\repsum.csv

4.Please check the SYSVOL replication is OK. That is all the contents in SYSVOL are the same on all DCs.
5.Please check FSMO roles by running netdom query fsmo on any one domain controller.
6.Check group policy on Domain Controller are working fine, run gpupdate /force on each Domain Controllers.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.