Active Directory Domain Services (AD DS) Troubleshooting Survival Guide and Content Map

Active Directory Domain Services (AD DS) Troubleshooting Survival Guide and Content Map

This page categorizes the Active Directory troubleshooting information that is spread all over the Internet, so you can get to the resource you need to solve your specific issue.

Troubleshooting Overviews

You might want to check out these overviews, flow charts, and general Active Directory troubleshooting strategy resources if you are not quite sure where to start:

Collecting Information

The following topics contain information that can help you gather more information about the problems that you are experiencing:

Useful Utilities

DCdiag - general domain controller diagnostics especially dcdiag /fix on a domain controller
Netdiag - general network diagnostics, especially useful is netdiag /fix for Windows Server 2003 R2 and earlier implementations
Netdom - used for resetting domain member computer secure channels and setting up trust relationships
ADSIEdit - used for browsing Active Directory structure from an LDAP perspective
LDP - LDAP browser that can be used for browsing, finding, and modifying the security settings of Active Directory objects
Insight for Active Directory - Intercepts and displays LDAP and ADSI calls to show you what is happening when Active Directory is accessed from the system on which it is installed.
ACLDiag - shows permissions set on Active Directory objects
SDCheck - Security Descriptor Checker is used to query security descriptor information on Active Directory objects
DSAStat - used to compare Active Directory replica sets
NTFRSUtil - used to monitor and diagnose issues with the NT File Replication System used for Active Directory replication by default in Windows Server 2003 R2 and earlier. Starting in Windows Server 2008 Directory File Service Replication (DFSR) was enabled by default on new forests
Repadmin - used for monitoring and troubleshooting Active Directory replication
Replmon - a graphical replication troubleshooting tool for Windows Server 2003 R2 and earlier - deprecated starting in Windows Server 2008
Codeplex Active Directory Utilities - Multiple tools available for Active Directory from this site
Useful Microsoft Active Directory Tools - Another site that is dedicated to discussing Active Directory tools.
Active Directory Replication Status Tool  - GUI tool released 7/2012 to analyze and check replication status.

Active Directory Events

Starting with Windows Server 2008 the most frequently encountered event viewer messages have been targeted for more information. There are two big collections in the TechNet Library that we are planning to move onto the TechNet Wiki, so that a larger group of people can help provide assistance in getting them documented.

There are also people working on a similar endeavor at EventID.Net, where you can search for more information by providing the Event Source and ID. A similar mechanism exists on the TechNet Errors and Events Message Center.  This TechNet Wiki may one day be the best place to find more information on Events and Errors as there are several people working on fleshing these out on this platform. More about that in the following section.

Event Sources

The vision for this section is to link from each of the following event sources below to pages that discuss the event source and link out to specific Event IDs. The Event ID pages will then provide troubleshooting information specific to the event. We are already working on this as you can see in Event ID 1311. Our goal is for each page to provide the information that people will need to solve the issues they encounter. There are many people already committed to this effort and working on it. Still, we can use all the help we can get; if you are inclined to help - we encourage you to do so.


Active Directory Limitations

There are many different factors that can limit the scale and performance of Active Directory. Here are articles that discuss them:

Active Directory Replication Issues

Resources that will help you troubleshoot Active Directory replication issues include:

Services or Access Denied

If the user account you are using truly does not have permissions to perform an action in Active Directory, you will likely receive an Access Denied message. To see if you are using an account with the appropriate privileges, see Privileges. To learn more about permissions and the specific permissions required to perform specific tasks, see Best Practices for Delegating Active Directory Permissions: Appendices.

You might also need a service principal name (SPN) for your service in Active Directory. To learn more about troubleshooting SPNs, take a look at Service Principal Names (SPNs).

Sometimes the reason for an access denied message may be related to something that is not immediately obvious. For example, it is possible that the computer was set to Shutdown the system immediately if unable to log security events or the CrashOnAuditFail Registry value was set. You may have to log on interactively or directly to the console (Session 0). For more information, see Services Denied and Computer Unresponsive When Security Event Log is Full." For more information about Session 0, see Scheduled Tasks Run in the Context of Session 0 with Terminal Services and How to Connect to and Shadow the Console Session with Windows Server 2003 Terminal Services and Application Compatibility Session 0 Isolation.

Performance Issues

Blogs with Troubleshooting Information

AD Troubleshooting blog
Ask the Directory Services Team

Similar Guides

Leave a Comment
  • Please add 7 and 6 and type the answer here:
  • Post
Wiki - Revision Comment List(Revision Comment)
Sort by: Published Date | Most Recent | Most Useful
  • Mike Kline edited Revision 33. Comment: AD replication status tool

  • Richard Mueller edited Revision 32. Comment: Fix <a name> tags in HTML to improve TOC

  • Richard Mueller edited Revision 31. Comment: Fix grammer

  • Richard Mueller edited Revision 30. Comment: Fixed HTML so TOC works better

  • Richard Mueller edited Revision 27. Comment: Modified the tags

  • Kurt L Hudson edited Revision 26. Comment: Updated TOC link and added Blogs with Troubleshooting INformation

  • Kurt L Hudson edited Revision 25. Comment: Changed the title yet again to try to make it clear in two of the popular nomenclatures that are being used

  • Kurt L Hudson edited Revision 24. Comment: Added Survival Guide to the title

  • Kurt L Hudson edited Revision 23. Comment: Reverting thjis article, modified by Kurt Hudson during demo

  • Kurt L Hudson edited Revision 22. Comment: Demo

Page 1 of 4 (31 items) 1234
Wikis - Comment List
Sort by: Published Date | Most Recent | Most Useful
Posting comments is temporarily disabled until 10:00am PST on Saturday, December 14th. Thank you for your patience.
  • Kurt L Hudson edited Original. Comment: Added more information and links and reformatting others

  • Kurt L Hudson edited Revision 1. Comment: Continuing to add information

  • Kurt L Hudson edited Revision 2. Comment: Continuing updates: Microsoft-Windows-ActiveDirectory_DomainService

  • Kurt L Hudson edited Revision 3. Comment: Fixing formatting

  • Kurt L Hudson edited Revision 5. Comment: Added some utilities, still there is much to do. :-)

  • Kurt L Hudson edited Revision 6. Comment: More resources added

  • Kurt L Hudson edited Revision 7. Comment: Updating event landing locations

  • Great article, thanks Mike...Keep up the good work :)

    Is there anything like this for PowerShell?

  • My Bad...I mean to say Kurt, Great Job Kurt....

  • Kurt L Hudson edited Revision 8. Comment: Added more liniks to more information

  • Kurt L Hudson edited Revision 9. Comment: Added link to Codeplex tools

  • Thanks Gulab. There is a PowerShell survival guide: I have added some related guides search links to help in finding similar items. I did not see one exactly like this for PowerShell yet, but you could create one and ask for PowerShell enthusiasts to help fill it out. I have a few people I would ask to help, if you do.

  • Kurt L Hudson edited Revision 10. Comment: Adding some related guides, since I was asked about it.

  • Kurt L Hudson edited Revision 11. Comment: added ADInsight

  • Excellent article which I think is valuable for professionals who manage the Active Directory

Page 1 of 4 (46 items) 1234