Basic steps to troubleshoot AD

What are the basic steps to troubleshoot Active Directory (AD)?

1. DCDIAG

To deploy an additional domain controller: 
dcdiag /test:dcpromo /DnsDomain:domain_name.com /ReplicaDC
To deploy a child domain:
dcdiag /test:dcpromo /DnsDomain:child_domain_name.forest.com /ChildDomain

Test the FSMO
dcdiag /s:<DomainControllerName> /test:fsmocheck

Check DNS
dcdiag /test:dns
Check for missing and duplicate SPNs as well as other errors
dcdiag /test:checksecurityerror

Check the rid pool
dcdiag /s:server /v /test:ridmanager

2. NSLOOKUP

Test SRV records
cmd > nslookup
set q=srv
_ldap._tcp.dc._msdcs.yourdomain.com
_ldap._tcp.gc._msdcs.yourdomain.com
_ldap._tcp.pdc._msdcs.yourdomain.com

3. Repadmin

Disable replication
repadmin /options <dc-fqdn> +DISABLE_OUTBOUND_REPL
Enable replication

repadmin /options <dc-fqdn> -DISABLE_OUTBOUND_REPL

4. W32TM

Time sync issue in DC
w32tm /config /manualpeerlist:<DC1.contoso.com> /syncfromflags:manual /update

5. NLTEST

How to find the site for a Server
nltest /server:%computername% /dsgetsitenltest /dsgetdc:contoso.com 
Reset the netlogon secure channel

nltest /sc_reset:<domainname>

NLTEST to test the trust relationship between a workstation and domain

6. PortQuery

PortQry.exe -n 10.236.214.136 -e 53 -p both

7. How to check the delegation

Dsrevoke /Report OU=test,DC=gs,DC=Com gs\bshwjt
ACLDiag.exe "OU=Employee,DC=Contoso,DC=Com" /chkdeleg 


For details see the below links.
http://social.technet.microsoft.com/wiki/contents/articles/6477.how-to-view-or-delete-active-directory-delegated-permissions.aspx


http://msmvps.com/blogs/acefekay/archive/2012/02/07/active-directory-server-2008-r2-you-do-not-have-permission-to-modify-the-group.aspx 

8. RUNAS

runas /user:<domain\username> cmd

Comments

Popular posts from this blog

How To Add Print Button to Blogger Posts

INSTALL CISCO VPN CLIENT ON WINDOWS 10 (32 & 64 BIT). FIX REASON 442