{"id":1366,"date":"2018-02-14T11:43:10","date_gmt":"2018-02-14T11:43:10","guid":{"rendered":"http:\/\/activedirectorypro.com\/?p=1366"},"modified":"2023-11-06T13:03:33","modified_gmt":"2023-11-06T13:03:33","slug":"dcdiag-check-domain-controller-health","status":"publish","type":"post","link":"https:\/\/activedirectorypro.com\/dcdiag-check-domain-controller-health\/","title":{"rendered":"Dcdiag: How to Check Domain Controller Health"},"content":{"rendered":"\n<p>In this tutorial, I&#8217;ll show you how to use the Dcdiag command line utility to perform a domain controller health Check and test DNS. <\/p>\n\n\n\n<p>I&#8217;ll also show you a GUI tool that lets you check the health of multiple domain controllers at once. <\/p>\n\n\n\n<p>Be sure to check the examples section below and I&#8217;ll show you the output of a normal domain controller and one that has issues.<\/p>\n\n\n\n<p><strong>Table of contents:<\/strong><\/p>\n\n\n\n<ul>\n<li><a href=\"#what-is-dcdiag\">What is Dcdiag<\/a><\/li>\n\n\n\n<li><a href=\"#how-to-install-dcdiag\">How to install Dcdiag<\/a><\/li>\n\n\n\n<li><a href=\"#check-active-directory-health-using-dcdiag\">Check Active Directory Health Using Dcdiag<\/a><\/li>\n\n\n\n<li><a href=\"#toolkit\" data-type=\"internal\" data-id=\"#toolkit\">Check Domain Controller Health with AD Pro Toolkit<\/a><\/li>\n\n\n\n<li><a href=\"#automate-ad-health-check\">Automate AD Health Check<\/a> (Email Report)<\/li>\n\n\n\n<li><a href=\"#diagnostic-tests\">Active Directory Diagnostic Tests <\/a><\/li>\n<\/ul>\n\n\n\n<p>Let&#8217;s dive right in.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-is-dcdiag\">What is Dcdiag<\/h2>\n\n\n\n<p>Dcdiag is a Microsoft Windows command line utility that can analyze the state of domain controllers in a forest or enterprise. You can choose to analyze a single domain controller or all DC&#8217;s in a forest.<\/p>\n\n\n\n<p>You might be thinking, how well does a command line utility really do at testing and finding issues with domain controllers?<\/p>\n\n\n\n<p>Well, it actually does a pretty good job! I was surprised to find out how many different tests this command actually did.<\/p>\n\n\n\n<p>I counted a total of 30 different tests, and some tests had multiple tests.<\/p>\n\n\n\n<p>So what does Dcdiag actually do? What kinds of tests does it perform?<\/p>\n\n\n\n<p>You can view a list of tests in the command help menu,&nbsp;&nbsp;run dcdiag \/? to see the help menu.<\/p>\n\n\n\n<p>I&#8217;ll have to admit the descriptions from the help command are not that helpful. I came across a good blog post by Ned Pyle called <a rel=\"noopener noreferrer\" href=\"https:\/\/blogs.technet.microsoft.com\/askds\/2011\/03\/22\/what-does-dcdiag-actually-do\/\" target=\"_blank\">What does DCDiag actually do<\/a> that explains each test in more details. If you are interested in learning exactly what the Dcdiag command does then I recommend you read that post.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-to-install-dcdiag\">How to install Dcdiag<\/h2>\n\n\n\n<p>If you want to run Dcdiag or use the Active Directory Health Check tool you will need to <a href=\"https:\/\/activedirectorypro.com\/install-rsat-remote-server-administration-tools-windows-10\/\" data-type=\"post\" data-id=\"686\">install the RSAT tools<\/a>. <\/p>\n\n\n\n<p>There is a really good chance that you already have the Dcdiag tool installed.<\/p>\n\n\n\n<p>If you have the AD DS role installed&nbsp;then Dcdiag is already installed.<\/p>\n\n\n\n<p>If you have the Remote Server Administration Tools (RSAT) tools installed then you already have Dcdiag installed.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"check-active-directory-health-using-dcdiag\">Check Active Directory Health Using Dcdiag (examples)<\/h2>\n\n\n\n<p>DCDiag is very easy to use.<\/p>\n\n\n\n<p>There are several different command line switches that can be used with Dcdiag, to view them all just use this command dcdiag \/?<\/p>\n\n\n\n<p>Here is an overview of the switches I&#8217;ll be using in the examples below.<\/p>\n\n\n\n<p>\/s: dcname switch is used to run Dcdiag against a remote server<\/p>\n\n\n\n<p>\/v: switch prints more detailed information about each test<\/p>\n\n\n\n<p>\/c: switch means comprehensive, this will run all tests including the dns test.<\/p>\n\n\n\n<p>\/q: switch will only print errors. This is useful as dcdiag can display a lot of information, if you want to see just the errors then use this switch.<\/p>\n\n\n\n<p>\/f: switch is used to redirect the results to a file.<\/p>\n\n\n\n<p><strong>TIP:<\/strong> When running dcdiag it will probably report some errors but this doesn&#8217;t necessarily mean you have issues with your domain controllers.&nbsp; For example, the command will query the system logs on the DC and display errors logs, but they could be errors from a computer or another server. Again this may not be a DC issue. You will just have to review and determine if it&#8217;s related or not.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"video-tutorial\">Video Tutorial<\/h2>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"DCDiag How to check Domain Controller Health\" width=\"1200\" height=\"675\" src=\"https:\/\/www.youtube.com\/embed\/w2Pa2ztBwlI?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<p>If you don&#8217;t like video tutorials or want more details, then continue reading the instructions below.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"example-1-use-s-to-run-against-a-remote-server\">Example 1: Use \/s to run against a remote server<\/h3>\n\n\n\n<p>This will run all the DC tests against the remote server DC1.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">dcdiag \/s:DC1<\/pre>\n\n\n\n<p>To run this on a local server just leave off the \/s:servername<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"example-2-using-v-to-display-more-details\">Example 2: Using \/v to display more details<\/h3>\n\n\n\n<p>The verbose switch will display additional details. It does the same tests as the first example it just displays more details about each test.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">dcdiag \/s:DC1&nbsp; \/v<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"example-3-using-f-to-save-to-a-log-file\">Example 3: Using \/f to save to a log file<\/h3>\n\n\n\n<p>By using the \/f you can save the results to a text file.&nbsp; This is great for logging the results and reviewing them at a later time.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">dcdiag \/s:DC1 \/f:c:\\it\\dcdiag_test.txt<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"example-4-using-a-to-run-against-all-domain-controllers\">Example 4: Using \/a to run against all domain controllers<\/h3>\n\n\n\n<p>If you have multiple domain controllers and want to test them all at once, then use this command.&nbsp; If you have many domain controllers this will be a lot of information displayed, this is where using the \/f option would come in handy.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">dcdiag \/s:DC1 \/a<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"example-5-use-q-to-only-display-the-errors\">Example 5: Use \/q to only display the errors<\/h3>\n\n\n\n<p>DCDiag can display a lot of information, to remove the noise and only display the errors use this command.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">dcdiag \/s:DC1 \/q<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"example-6-use-multiple-switches-my-favorite\">Example 6: Use multiple switches (My favorite)<\/h3>\n\n\n\n<p>Here are the commands I like to run. It will run all tests, displays all the details, and outputs its to a file.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">dcdiag \/s:DC1 \/c \/v \/f:c:\\it\\dcdiag_test.txt<\/pre>\n\n\n\n<p>Now that you know how to test your domain controllers I&#8217;ll move on to testing DNS. By the way, if you use the last example that includes the \/c that switch will run all tests including DNS.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-to-test-dns-with-dcdiag\">How to test DNS with DCDiag<\/h2>\n\n\n\n<p>The DNS diagnostics also includes several tests.<\/p>\n\n\n\n<p>Here are the tests that are performed, by default all tests except external name resolution run.<\/p>\n\n\n\n<p>\/DnsBasic (basic tests, can&#8217;t be skipped)<br>\/DnsForwarders (forwarders and root hints tests)<br>\/DnsDelegation (delegations tests)<br>\/DnsDynamicUpdate (dynamic update tests)<br>\/DnsRecordRegistration (records registration tests)<br>\/DnsResolveExtName (external name resolution test)<br>\/DnsAll (includes all tests above)<br>\/DnsInternetName: &lt;internet name&gt; (for test \/DnsResolveExtName)<\/p>\n\n\n\n<p>Use the following command to run a DNS test<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">dcdiag \/s:dc1 \/test:dns<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"example-dcdiag-results-from-a-normal-domain-controller\">Example: Dcdiag results from a normal domain controller<\/h3>\n\n\n\n<pre class=\"wp-block-preformatted\">Directory Server Diagnosis\nPerforming initial setup:\n* Identified AD Forest.\nDone gathering initial info.\n\nDoing initial required tests\n\nTesting server: Default-First-Site-Name\\DC1\nStarting test: Connectivity\n......................... DC1 passed test Connectivity\n\nDoing primary tests\n\nTesting server: Default-First-Site-Name\\DC1\nStarting test: Advertising\n......................... DC1 passed test Advertising\nStarting test: FrsEvent\n......................... DC1 passed test FrsEvent\nStarting test: DFSREvent\n......................... DC1 passed test DFSREvent\nStarting test: SysVolCheck\n......................... DC1 passed test SysVolCheck\nStarting test: KccEvent\n......................... DC1 passed test KccEvent\nStarting test: KnowsOfRoleHolders\n......................... DC1 passed test KnowsOfRoleHolders\nStarting test: MachineAccount\n......................... DC1 passed test MachineAccount\nStarting test: NCSecDesc\n......................... DC1 passed test NCSecDesc\nStarting test: NetLogons\n......................... DC1 passed test NetLogons\nStarting test: ObjectsReplicated\n......................... DC1 passed test ObjectsReplicated\nStarting test: Replications\n......................... DC1 passed test Replications\nStarting test: RidManager\n......................... DC1 passed test RidManager\nStarting test: Services\n......................... DC1 passed test Services\nStarting test: SystemLog ......................... DC1 passed test SystemLog Starting test: VerifyReferences\n......................... DC1 passed test VerifyReferences\n\nRunning partition tests on : ForestDnsZones\nStarting test: CheckSDRefDom\n......................... ForestDnsZones passed test CheckSDRefDom\nStarting test: CrossRefValidation\n......................... ForestDnsZones passed test CrossRefValidation\n\nRunning partition tests on : DomainDnsZones\nStarting test: CheckSDRefDom\n......................... DomainDnsZones passed test CheckSDRefDom\nStarting test: CrossRefValidation\n......................... DomainDnsZones passed test CrossRefValidation\n\nRunning partition tests on : Schema\nStarting test: CheckSDRefDom\n......................... Schema passed test CheckSDRefDom\nStarting test: CrossRefValidation\n......................... Schema passed test CrossRefValidation\n\nRunning partition tests on : Configuration\nStarting test: CheckSDRefDom\n......................... Configuration passed test CheckSDRefDom\nStarting test: CrossRefValidation\n......................... Configuration passed test CrossRefValidation\n\nRunning partition tests on : ad\nStarting test: CheckSDRefDom\n......................... ad passed test CheckSDRefDom\nStarting test: CrossRefValidation\n......................... ad passed test CrossRefValidation\n\nRunning enterprise tests on : ad.activedirectorypro.com\nStarting test: LocatorCheck\n......................... ad.activedirectorypro.com passed test LocatorCheck\nStarting test: Intersite\n......................... ad.activedirectorypro.com passed test Intersite<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"example-failed-kdc-service-and-netlogon-service\">Example: Failed kdc service and NETLOGON Service<\/h2>\n\n\n\n<p>Here is the dcdiag output when the kdc and NETLOGON service is stopped. I used the \/q switch to only display the errors<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">C:\\Users\\rallen&gt;dcdiag \/s:dc2 \/q\n Fatal Error:DsGetDcName (DC2) call failed, error 1717\n The Locator could not find the server.\n ......................... DC2 failed test Advertising\n kdc Service is stopped on [DC2]\n NETLOGON Service is stopped on [DC2]\n ......................... DC2 failed test Services\n Warning: DcGetDcName(GC_SERVER_REQUIRED) call failed, error 1717\n A Global Catalog Server could not be located - All GC's are down.\n Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1717\n A Primary Domain Controller could not be located.\n The server holding the PDC role is down.\n Warning: DcGetDcName(TIME_SERVER) call failed, error 1717\n A Time Server could not be located.\n The server holding the PDC role is down.\n Warning: DcGetDcName(GOOD_TIME_SERVER_PREFERRED) call failed, error 1717\n A Good Time Server could not be located.\n Warning: DcGetDcName(KDC_REQUIRED) call failed, error 1717\n A KDC could not be located - All the KDCs are down.\n ......................... ad.activedirectorypro.com failed test LocatorCheck<\/pre>\n\n\n\n<p>That&#8217;s it.<\/p>\n\n\n\n<p>Easy right?<\/p>\n\n\n\n<p>DCDiag is a simple yet very powerful tool to check and diagnose domain controllers. I highly recommend that you become familiar with this tool and run it in your environment from time to time.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"toolkit\">Check Active Directory Health with AD Pro Toolkit<\/h2>\n\n\n\n<p>The <a href=\"https:\/\/activedirectorypro.com\/active-directory-health-check-tool\/\" data-type=\"page\" data-id=\"35371\">Active Directory Health Check tool<\/a> creates easy to read health reports on your domain controllers. It makes it very easy to check the health of multiple domain controllers at once. <\/p>\n\n\n\n<p><strong>The GUI tool has the following benefits:<\/strong><\/p>\n\n\n\n<ul>\n<li>Easily check Active Directory health on multiple domain controllers<\/li>\n\n\n\n<li>Quickly see why a test failed by clicking on a test<\/li>\n\n\n\n<li>Gets important events from the Windows event logs (errors, warnings, critical errors)<\/li>\n\n\n\n<li>Export and schedule automated reports<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/activedirectorypro.com\/wp-content\/uploads\/2023\/11\/check-domain-controller-health-1.webp\"><img decoding=\"async\" loading=\"lazy\" width=\"871\" height=\"652\" src=\"https:\/\/activedirectorypro.com\/wp-content\/uploads\/2023\/11\/check-domain-controller-health-1.webp\" alt=\"\" class=\"wp-image-43944\" srcset=\"https:\/\/activedirectorypro.com\/wp-content\/uploads\/2023\/11\/check-domain-controller-health-1.webp 871w, https:\/\/activedirectorypro.com\/wp-content\/uploads\/2023\/11\/check-domain-controller-health-1-300x225.webp 300w, https:\/\/activedirectorypro.com\/wp-content\/uploads\/2023\/11\/check-domain-controller-health-1-768x575.webp 768w\" sizes=\"(max-width: 871px) 100vw, 871px\" \/><\/a><\/figure>\n\n\n\n<p>This tool can also get the critical events from your domain controllers. This makes it easy to review the logs and quickly spot potential issues. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"802\" height=\"402\" src=\"https:\/\/activedirectorypro.com\/wp-content\/uploads\/2022\/07\/dcdiag-page-event-logs.webp\" alt=\"\" class=\"wp-image-29684\" srcset=\"https:\/\/activedirectorypro.com\/wp-content\/uploads\/2022\/07\/dcdiag-page-event-logs.webp 802w, https:\/\/activedirectorypro.com\/wp-content\/uploads\/2022\/07\/dcdiag-page-event-logs-300x150.webp 300w, https:\/\/activedirectorypro.com\/wp-content\/uploads\/2022\/07\/dcdiag-page-event-logs-768x385.webp 768w, https:\/\/activedirectorypro.com\/wp-content\/uploads\/2022\/07\/dcdiag-page-event-logs-600x301.webp 600w\" sizes=\"(max-width: 802px) 100vw, 802px\" \/><\/figure>\n\n\n\n<p>You can download a free trial of this GUI health monitoring tool by clicking the button below. <\/p>\n\n\n<div class=\"gb-button-wrapper gb-button-wrapper-76f6b072\">\n\n<a class=\"gb-button gb-button-7f92fc8a gb-button-text\" href=\"https:\/\/activedirectorypro.com\/download-thank-you\/\">Download Free Trial<\/a>\n\n<\/div>\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"automate-ad-health-check\">Automate AD Health Check (Email Report)<\/h2>\n\n\n\n<p>Automate checking the health of your domain controllers by using the built-in scheduler. Schedule the report to run daily, weekly, or once a month (I recommend daily). <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"910\" height=\"614\" src=\"https:\/\/activedirectorypro.com\/wp-content\/uploads\/2023\/11\/check-domain-controller-health-2.webp\" alt=\"\" class=\"wp-image-43946\" srcset=\"https:\/\/activedirectorypro.com\/wp-content\/uploads\/2023\/11\/check-domain-controller-health-2.webp 910w, https:\/\/activedirectorypro.com\/wp-content\/uploads\/2023\/11\/check-domain-controller-health-2-300x202.webp 300w, https:\/\/activedirectorypro.com\/wp-content\/uploads\/2023\/11\/check-domain-controller-health-2-768x518.webp 768w\" sizes=\"(max-width: 910px) 100vw, 910px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>In this tutorial, I&#8217;ll show you how to use the Dcdiag command line utility to perform a domain controller health Check and test DNS. I&#8217;ll also show you a GUI tool that lets you check the health of multiple domain controllers at once. Be sure to check the examples section below and I&#8217;ll show you &#8230; <a title=\"Dcdiag: How to Check Domain Controller Health\" class=\"read-more\" href=\"https:\/\/activedirectorypro.com\/dcdiag-check-domain-controller-health\/\" aria-label=\"More on Dcdiag: How to Check Domain Controller Health\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":27888,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1835],"tags":[],"_links":{"self":[{"href":"https:\/\/activedirectorypro.com\/wp-json\/wp\/v2\/posts\/1366"}],"collection":[{"href":"https:\/\/activedirectorypro.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/activedirectorypro.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/activedirectorypro.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/activedirectorypro.com\/wp-json\/wp\/v2\/comments?post=1366"}],"version-history":[{"count":2,"href":"https:\/\/activedirectorypro.com\/wp-json\/wp\/v2\/posts\/1366\/revisions"}],"predecessor-version":[{"id":43951,"href":"https:\/\/activedirectorypro.com\/wp-json\/wp\/v2\/posts\/1366\/revisions\/43951"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/activedirectorypro.com\/wp-json\/wp\/v2\/media\/27888"}],"wp:attachment":[{"href":"https:\/\/activedirectorypro.com\/wp-json\/wp\/v2\/media?parent=1366"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/activedirectorypro.com\/wp-json\/wp\/v2\/categories?post=1366"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/activedirectorypro.com\/wp-json\/wp\/v2\/tags?post=1366"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}