Start here
Is the whole domain healthy?
dcdiag /vIs replication working?
repadmin /replsummaryWhich DC am I talking to?
nltest /dsgetdc:corp.localIs the clock right?
w32tm /query /statusDid I get a Kerberos ticket?
klistIs the machine account intact?
nltest /sc_verify:corp.local
Order matters. Time, then secure channel, then replication, then the service itself. Kerberos sits under all of it, so a clock five minutes out makes every other test lie.
Domain controller discovery
| Task | Command |
|---|---|
| Which DC serves this machine | nltest /dsgetdc:corp.local |
| Force a fresh discovery, ignore the cache | nltest /dsgetdc:corp.local /force |
| All DCs in the domain | nltest /dclist:corp.local |
| Which AD site this machine is in | nltest /dsgetsite |
| All trusts of this domain | nltest /domain_trusts /v |
| Find the PDC emulator | netdom query fsmo |
| Domain and forest functional level | Get-ADDomain | Select-Object DomainMode |
Secure channel and machine account
| Task | Command |
|---|---|
| Query the secure channel | nltest /sc_query:corp.local |
| Verify it end to end | nltest /sc_verify:corp.local |
| Reset it without rejoining | nltest /sc_reset:corp.local |
| PowerShell test, returns True or False | Test-ComputerSecureChannel |
| PowerShell repair, needs credentials | Test-ComputerSecureChannel -Repair -Credential (Get-Credential) |
| Reset the machine account password | Reset-ComputerMachinePassword -Server SRV-DC01 |
Do not rejoin first. A rejoin creates a new SID relationship and loses group memberships assigned to the computer object. Try
nltest /sc_reset or Test-ComputerSecureChannel -Repair before removing anything from the domain.
Replication
| Task | Command |
|---|---|
| Forest-wide summary, worst first | repadmin /replsummary /bysrc /bydest /sort:delta |
| Only the failing connections | repadmin /showrepl * /errorsonly |
| Everything, as CSV | repadmin /showrepl * /csv |
| Push changes out from one DC | repadmin /syncall SRV-DC01 /AdeP |
| Replicate one partition, one pair | repadmin /replicate SRV-DC02 SRV-DC01 dc=corp,dc=local |
| What a DC still has to fetch | repadmin /queue SRV-DC02 |
| Who last changed an attribute | repadmin /showobjmeta SRV-DC01 "CN=svc-backup,OU=Service Accounts,DC=corp,DC=local" |
| Recalculate the topology | repadmin /kcc |
| PowerShell, all failures in the forest | Get-ADReplicationFailure -Target corp.local -Scope Forest |
Health tests
| Task | Command |
|---|---|
| Everything, verbose | dcdiag /v |
| One named DC | dcdiag /s:SRV-DC01 |
| Every DC in the enterprise | dcdiag /e |
| Replication only | dcdiag /test:Replications /v |
| DNS, the full suite | dcdiag /test:DNS /e /v |
| Is the DC advertising its roles | dcdiag /test:Advertising |
| Netlogon share and permissions | dcdiag /test:NetLogons |
| Save the output for the ticket | dcdiag /v /f:C:\logs\dcdiag.txt |
Time synchronisation
| Task | Command |
|---|---|
| Source, stratum, last successful sync | w32tm /query /status |
| Just the source | w32tm /query /source |
| Effective settings and where they came from | w32tm /query /configuration |
| Offset of every DC in the domain | w32tm /monitor |
| Sample the offset against one host | w32tm /stripchart /computer:SRV-DC01 /samples:10 /dataonly |
| Resync now, rediscovering the source | w32tm /resync /rediscover |
| PDC emulator, external source | w32tm /config /manualpeerlist:"0.pool.ntp.org,0x9" /syncfromflags:manual /reliable:yes /update |
| Member server, back to the hierarchy | w32tm /config /manualpeerlist:"" /syncfromflags:domhier /update |
Source: Local CMOS Clock means the machine is not synchronising with anything. The service is running, nothing is logged, and the clock drifts until Kerberos refuses tickets.
Kerberos tickets
| Task | Command |
|---|---|
| Tickets in this session | klist |
| The TGT on its own | klist tgt |
| Discard them, pick up new group membership | klist purge |
| All logon sessions with their LUIDs | klist sessions |
| The SYSTEM session, used by services | klist -li 0x3e7 tickets |
| Purge the SYSTEM session | klist -li 0x3e7 purge |
| Request a ticket for one SPN | klist get HTTP/app.corp.local |
| Which DC Kerberos is using | klist query_bind |
| Groups in the current token | whoami /groups |
Service principal names
| Task | Command |
|---|---|
| List SPNs on an account | setspn -L svc-web |
| Find which account owns an SPN | setspn -Q HTTP/app.corp.local |
| Find duplicates across the forest | setspn -X -F |
| Add an SPN with a duplicate check | setspn -S HTTP/app.corp.local svc-web |
| Remove an SPN | setspn -D HTTP/app.corp.local svc-web |
Always use
-S, never -A. -S refuses to create a duplicate. A duplicate SPN breaks Kerberos for both accounts and is invisible until someone runs setspn -X.
Querying the directory
| Task | Command |
|---|---|
| Find a user by name | dsquery user -name "John*" |
| Accounts inactive for 4 weeks | dsquery user -inactive 4 |
| Members of a group | dsget group "CN=FileAdmins,OU=Groups,DC=corp,DC=local" -members |
| Groups a user belongs to | dsquery user -samid jsmith | dsget user -memberof -expand |
| Disabled computer accounts | dsquery computer -disabled |
| PowerShell equivalent | Get-ADUser -Filter 'Enabled -eq $false' -Properties LastLogonDate |
Error codes worth recognising
| Code | Meaning | Where to look first |
|---|---|---|
1256 | The remote system is not available | Network path to the partner DC |
1722 | The RPC server is unavailable | Firewall, RPC ports, name resolution |
1908 | Could not find the domain controller | DNS, site configuration |
8453 | Replication access was denied | Permissions, and clock skew via Kerberos |
8524 | DSA operation failed on a DNS lookup | The CNAME under _msdcs |
8606 | Insufficient attributes to create an object | Lingering objects on a long-disconnected DC |
FAQ
A user was added to a group and still cannot access the share. What now?
Group membership travels inside the Kerberos ticket, and the ticket was issued at logon. Run
klist purge in the user’s session and reconnect, or have them log off and back on. If it still fails, the change may not have replicated to the DC that authenticates them: check with repadmin /showrepl * /errorsonly.
Which do I run first, dcdiag or repadmin?
dcdiag tells you which component failed. repadmin tells you which link, which partition and which error code. Start with repadmin /replsummary when the symptom is inconsistent data between sites, and with dcdiag /v when a domain controller itself is misbehaving.
How much clock skew does Kerberos tolerate?
Five minutes by default, set by the maximum tolerance for computer clock synchronisation in the Default Domain Policy. Past that, tickets are refused and the symptom looks like a permissions problem.
w32tm /monitor shows the offset of every DC in one command.
Is it safe to force replication during the working day?
repadmin /syncall /AdeP pushes only the changes that have not replicated yet, so on a healthy domain it is cheap. It is not safe on a DC that has been disconnected longer than the tombstone lifetime, which is 180 days on any forest built on Windows Server 2003 SP1 or later. That DC should be demoted and rebuilt, not synchronised.
The secure channel is broken. Rejoin the domain?
Not first.
nltest /sc_reset:corp.local or Test-ComputerSecureChannel -Repair fixes it in place and keeps the existing computer object, its SID and any group memberships attached to it. Rejoining discards all of that.
Which of these need Domain Admin?
Reading is mostly available to any authenticated user:
klist, w32tm /query, nltest /dsgetdc, dsquery. Writing and most of repadmin and dcdiag need Domain Admins or delegated rights, and everything on a domain controller needs an elevated prompt.