This page categorizes the Active Directory troubleshooting information that is spread all over the Internet, so you can get to the resource you need to solve your specific issue.

Troubleshooting Overviews

You might want to check out these overviews, flow charts, and general Active Directory troubleshooting strategy resources if you are not quite sure where to start:

• Active Directory Troubleshooting Flow Chart (PDF by Sean Deuby)
• Active Directory Troubleshooting Overview (written for Windows 2000, but much of it still applies)
• High-level Methodology for Troubleshooting Active Directory Problems

Collecting Information

The following topics contain information that can help you gather more information about the problems that you are experiencing:

• Active Directory Diagnostic Logging 
• Configuring Diagnostic Logging on a Server 
• Hey, Scripting Guy! How Can I Query Event Logs to Discover Active Directory Information?  

Useful Utilities

DCdiag - general domain controller diagnostics especially dcdiag /fix on a domain controller
Netdiag - general network diagnostics, especially useful is netdiag /fix for Windows Server 2003 R2 and earlier implementations
Netdom - used for resetting domain member computer secure channels and setting up trust relationships
ADSIEdit - used for browsing Active Directory structure from an LDAP perspective
LDP - LDAP browser that can be used for browsing, finding, and modifying the security settings of Active Directory objects
Insight for Active Directory - Intercepts and displays LDAP and ADSI calls to show you what is happening when Active Directory is accessed from the system on which it is installed.
ACLDiag - shows permissions set on Active Directory objects
SDCheck - Security Descriptor Checker is used to query security descriptor information on Active Directory objects
DSAStat - used to compare Active Directory replica sets
NTFRSUtil - used to monitor and diagnose issues with the NT File Replication System used for Active Directory replication by default in Windows Server 2003 R2 and earlier. Starting in Windows Server 2008 Directory File Service Replication (DFSR) was enabled by default on new forests
Repadmin - used for monitoring and troubleshooting Active Directory replication
Replmon - a graphical replication troubleshooting tool for Windows Server 2003 R2 and earlier - deprecated starting in Windows Server 2008
Codeplex Active Directory Utilities - Multiple tools available for Active Directory from this site
Useful Microsoft Active Directory Tools - Another site ad-active-directory-tools.com that is dedicated to discussing Active Directory tools.
Active Directory Replication Status Tool  - GUI tool released 7/2012 to analyze and check replication status.

Active Directory Events

Starting with Windows Server 2008 the most frequently encountered event viewer messages have been targeted for more information. There are two big collections in the TechNet Library that we are planning to move onto the TechNet Wiki, so that a larger group of people can help provide assistance in getting them documented.

• Windows Server 2008 Troubleshooting
• Windows Server 2008 R2 Troubleshooting

There are also people working on a similar endeavor at EventID.Net, where you can search for more information by providing the Event Source and ID. A similar mechanism exists on the TechNet Errors and Events Message Center.  This TechNet Wiki may one day be the best place to find more information on Events and Errors as there are several people working on fleshing these out on this platform. More about that in the following section.

Event Sources

The vision for this section is to link from each of the following event sources below to pages that discuss the event source and link out to specific Event IDs. The Event ID pages will then provide troubleshooting information specific to the event. We are already working on this as you can see in Event ID 1311. Our goal is for each page to provide the information that people will need to solve the issues they encounter. There are many people already committed to this effort and working on it. Still, we can use all the help we can get; if you are inclined to help - we encourage you to do so.

Microsoft-Windows-ActiveDirectory_DomainService
SAM
Microsoft-Windows-Time-Service
LsaSrv
NetLogon

Active Directory Limitations

There are many different factors that can limit the scale and performance of Active Directory. Here are articles that discuss them:

• Active Directory Maximum Limits - Scalability
• Maximum Size of Active Directory Searches

Active Directory Replication Issues

Resources that will help you troubleshoot Active Directory replication issues include:

• Monitoring and Troubleshooting Active Directory Replication Using Repadmin
• Troubleshooting Replication 
• Monitoring and Troubleshooting Active Directory Replication (Part 1 of a 3 part series of articles)
• Troubleshooting Active Directory Replication Problems (MSDN)
• Troubleshooting Active Directory Replication Problems (TechNet)

Services or Access Denied

If the user account you are using truly does not have permissions to perform an action in Active Directory, you will likely receive an Access Denied message. To see if you are using an account with the appropriate privileges, see Privileges. To learn more about permissions and the specific permissions required to perform specific tasks, see Best Practices for Delegating Active Directory Permissions: Appendices.

You might also need a service principal name (SPN) for your service in Active Directory. To learn more about troubleshooting SPNs, take a look at Service Principal Names (SPNs).

Sometimes the reason for an access denied message may be related to something that is not immediately obvious. For example, it is possible that the computer was set to Shutdown the system immediately if unable to log security events or the CrashOnAuditFail Registry value was set. You may have to log on interactively or directly to the console (Session 0). For more information, see Services Denied and Computer Unresponsive When Security Event Log is Full." For more information about Session 0, see Scheduled Tasks Run in the Context of Session 0 with Terminal Services and How to Connect to and Shadow the Console Session with Windows Server 2003 Terminal Services and Application Compatibility Session 0 Isolation.

Performance Issues

• High LSASS CPU Utilization

Blogs with Troubleshooting Information

AD Troubleshooting blog
Ask the Directory Services Team

Similar Guides

• Other Troubleshooting Guides