{"id":2016,"date":"2014-12-26T12:29:06","date_gmt":"2014-12-26T08:29:06","guid":{"rendered":"https:\/\/rakhesh.com\/?p=2016"},"modified":"2015-01-02T12:48:02","modified_gmt":"2015-01-02T08:48:02","slug":"active-directory-troubleshooting","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/windows\/active-directory-troubleshooting\/","title":{"rendered":"Active Directory: Troubleshooting"},"content":{"rendered":"<p>This is intended to be a &#8220;running post&#8221; with bits and pieces I find on AD troubleshooting. If I bookmark these I&#8217;ll forget them. But if I put them here I can search easily and also put some notes alongside.\u00a0<\/p>\n<h2>DCDiag switches and other commands<\/h2>\n<p>From <a href=\"https:\/\/dirteam.com\/paul\/2009\/01\/26\/troubleshooting-active-directory-issues\/\" target=\"_blank\">Paul Bergson<\/a>:<\/p>\n<ul>\n<li><code>dcdiag \/v \/c \/d \/e \/s:dcname &gt; c:\\dcdiag.log<\/code>\n<ul>\n<li><code>\/v<\/code> tells it to be verbose<\/li>\n<li><code>\/d<\/code> tells it to also show debug out &#8211; i.e. even more verbosity<\/li>\n<li><code>\/c<\/code> tells it to be comprehensive &#8211; do all the non-default tests too (except DCPromo and RegisterInDNS)<\/li>\n<li><code>\/e<\/code> tells it to test all servers in the enterprise &#8211; i.e. across site links<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>This prompted me to make a table with the list of <code>DcDiag<\/code> tests that are run by default and in comprehensive mode.\u00a0<\/p>\n<table style=\"height: 302px;\" width=\"695\">\n<tbody>\n<tr>\n<td><strong>Test Name<\/strong><\/td>\n<td><strong>By default?<\/strong><\/td>\n<td><strong>Comprehensive?<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Advertising<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>CheckSDRefDom<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>CheckSecurityError<\/td>\n<td>N<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>Connectivity<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>CrossRefValidation<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>CutOffServers<\/td>\n<td>N<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>DcPromo<\/td>\n<td>N\/A<\/td>\n<td>N\/A<\/td>\n<\/tr>\n<tr>\n<td>DNS<\/td>\n<td>N<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>FrsEvent<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>DFSREvent<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>SysVolCheck<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>LocatorCheck<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>Intersite<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>KccEvent<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>KnowsOfRoleHolders<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>MachineAccount<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>NCSecDesc<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>NetLogos<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>ObjectsReplicated<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>OutboundSecureChannels<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>RegisterInDNS<\/td>\n<td>N\/A<\/td>\n<td>N\/A<\/td>\n<\/tr>\n<tr>\n<td>Replications<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>RidManager<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>Services<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>SystemLog<\/td>\n<td>Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>Topology<\/td>\n<td>N<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>VerifyEnterpriseReferences<\/td>\n<td>N<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>VerifyReferences<\/td>\n<td>\u00a0Y<\/td>\n<td>Y<\/td>\n<\/tr>\n<tr>\n<td>VerifyReplicas<\/td>\n<td>N<\/td>\n<td>Y<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Replication error 1722 The RPC server is unavailable<\/h2>\n<p>Came across this after I setup a new child domain. Other DCs in the forest were unable to replicate to this for about 2 hours. The error was due to DNS &#8211; the <code>CNAME<\/code> records for the new DC hadn&#8217;t replicated yet.\u00a0<\/p>\n<p><a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/replication-error-1722-the-rpc-server-is-unavailable(d=printer,v=ws.10).aspx\" target=\"_blank\">This TechNet<\/a> post was a good read. Gives a few commands worth keeping in mind, and shows a logical way of troubleshooting.<\/p>\n<h2>Replication error 8524 The DSA operation is unable to proceed because of a DNS lookup failure<\/h2>\n<p><a href=\"http:\/\/technet.microsoft.com\/en-us\/library\/replication-error-8524-the-dsa-operation-is-unable-to-proceed-because-of-a-dns-lookup-failure(d=printer,v=ws.10).aspx\" target=\"_blank\">Another TechNet<\/a> post came across in relation to the above DNS issue.\u00a0<\/p>\n<p>This command is worth remembering:<\/p>\n<pre class=\"lang:batch decode:true\">repadmin \/showreps<\/pre>\n<p>Shows all the replication partners and a summary of last replication. Seems to be similar to:<\/p>\n<pre class=\"lang:batch decode:true \">repadmin \/showrepl<\/pre>\n<p>\u00a0Especially useful is the fact that both commands give the DSA GUIDs of the target DC and its partners:<\/p>\n<pre class=\"lang:batch decode:true \">C:\\Windows\\system32&gt;repadmin \/showreps | more\r\nKOTTAYAM\\WIN-DC02\r\nDSA Options: IS_GC\r\nSite Options: (none)\r\nDSA object GUID: 6fdae042-053c-47e2-be5f-67db18dfc088\r\nDSA invocationID: 2ba93522-4caf-4130-b946-b4069081c137\r\n\r\n==== INBOUND NEIGHBORS ======================================\r\n\r\nDC=rakhesh,DC=local\r\n    COCHIN\\WIN-DC03 via RPC\r\n        DSA object GUID: 33398129-7632-4014-a3b4-eabb2b74de8b\r\n        Last attempt @ 2015-01-02 12:26:07 was successful.\r\n\r\nCN=Configuration,DC=rakhesh,DC=local\r\n    KOTTAYAM\\WIN-DC04 via RPC\r\n        DSA object GUID: 1e8f2e00-76c6-4e7c-86da-63a398ee2095\r\n        Last attempt @ 2015-01-02 11:56:07 was successful.\r\n    KOTTAYAM\\WIN-DC05 via RPC\r\n        DSA object GUID: 3e82a06d-ec61-48a9-ac83-f68623fdfe85\r\n        Last attempt @ 2015-01-02 11:56:07 was successful.\r\n    COCHIN\\WIN-DC03 via RPC\r\n        DSA object GUID: 33398129-7632-4014-a3b4-eabb2b74de8b\r\n        Last attempt @ 2015-01-02 12:26:07 was successful.<\/pre>\n<p>It is possible to specify a DC by giving its name. Have the GUIDs is useful when you suspect DNS issues. Check that the <code>CNAME<\/code>s can be resolved from both source and destination DCs. \u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is intended to be a &#8220;running post&#8221; with bits and pieces I find on AD troubleshooting. If I bookmark these I&#8217;ll forget them. But if I put them here I can search easily and also put some notes alongside.\u00a0 DCDiag switches and other commands From Paul Bergson: dcdiag \/v \/c \/d \/e \/s:dcname &gt; &hellip; <a href=\"https:\/\/rakhesh.com\/windows\/active-directory-troubleshooting\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Active Directory: Troubleshooting<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[333,85],"tags":[4,367,317],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/2016"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=2016"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/2016\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=2016"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=2016"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=2016"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}