The Sysadmins

Tips and tricks from the Sysadmins

Active Directory Health Check Script

How do I know if Active Directory is healthy?

I’m having some Active directory issues, where do I start?

I see these questions asked a lot, and talking someone through some basic troubleshooting steps without having physical/remote access can be fairly time consuming. For that reason I’ve put together a script to collect basic information about the domain controller the script is run on and active directory itself- which is then written to a log file.

The log file is saved onto the current users desktop by default. If you want to save the log file to a share you’d use:

set logfile=\\server\share\ADHealth\ADHealth.txt

So, what does it do?

System Boot Time - systeminfo | find "System Boot Time:" – Displays boot time, not massively helpful or directly tied with Active Directory but still worth being aware of the last start-up time.

TCP/IP network configuration - IPCONFIG /all – Displays all current TCP/IP network configuration values. This is normally helpful to highlight any DNS server misconfiguration. For example setting them to external public resolvers.

DCDIAG /a – The meat and potatoes, there’s a great article on what it actually does here: This is currently set to test all domain controllers (/a), you can get more verbose with /v, but I quite like the initial log to be succinct.

Repadmin /replsummary – Will show you an overview of any failures, and for which DC(s).

Repadmin /showrepl – This will let you know if the last replication attempts where successful.

NETDOM Query FSMO – This will return the FSMO role holders, which can be used to confirm that the role holders are still online and functioning. A good article on FSMO roles and what happens if one of them fails can be found here:

Nslookup -querytype=srv _gc._tcp.%domain% – Displays all Global Catalogs.

The batch file

You can copy and paste it into your own batch file or download it from here. If you’re running it on a DC prior to Server 2008 you will need to install the Adminpak: Windows Server 2003 Service Pack 2 Administration Tools Pack (adminpak)

@Echo Off
ECHO Running AD Health Checks - Notepad will open after completion
ECHO You can share this log using
ECHO This Command Prompt will close after you close Notepad
set logfile=%userprofile%\Desktop\ADHealth.txt
echo You can share this log using > %logfile%
echo. >> %logfile%
echo. >> %logfile%
REM Finds system boot time
echo System Boot Time ------------------------------------------------------------- >> %logfile%
systeminfo | find "System Boot Time:" >> %logfile%
systeminfo | find "System Up Time:" >> %logfile%
echo. >> %logfile%
echo. >> %logfile%
REM Displays all current TCP/IP network configuration values
echo IPCONFIG ------------------------------------------------------------- >> %logfile%
ipconfig /all >> %logfile%
echo. >> %logfile%
echo. >> %logfile%
REM Analyse the state of domain controllers in a forest and reports any problems to assist in troubleshooting
echo DCDIAG ------------------------------------------------------------- >> %logfile%
dcdiag /a >> %logfile%
echo. >> %logfile%
echo. >> %logfile%
REM The replsummary operation quickly summarizes the replication state and relative health
echo Replsummary ------------------------------------------------------------- >> %logfile%
repadmin /replsummary >> %logfile%
echo. >> %logfile%
echo. >> %logfile%
REM Displays the replication partners for each directory partition on the specified domain controller
echo Showrepl ------------------------------------------------------------- >> %logfile%
repadmin /showrepl >> %logfile%
echo. >> %logfile%
echo. >> %logfile%
REM Query FSMO roles
echo NETDOM Query FSMO ------------------------------------------------------------- >> %logfile%
netdom query fsmo >> %logfile%
REM Query Global Catalogs
echo List Global Catalogs ------------------------------------------------------------- >> %logfile%
for /f "tokens=2" %%a in ('systeminfo ^| findstr Domain:') do set domain=%%a
nslookup -querytype=srv _gc._tcp.%domain% >> %logfile%
notepad %logfile%

Run the batch file, when it has completed notepad will open with the freshly created log. If you need to share this log with someone I suggest using, and pasting the (redacted) document.

ADHealth Batch

You may just want to run this as a one off when troubleshooting, or you may want to add this to a scheduled task (If so I’d remove the notepad %logfile% line off the end). This can be useful for comparisons and to outline when the error(s) / issues began. If your Active directory currently running like a dream, why not take a baseline log…

This script should give you a starting point for diagnosing some of the more common Active Directory issues. I recommend getting familiar with the tools included in the script, learning how to read and make sense of the information and to be aware of other parameters available.


  1. Thanks for the script. It didn’t work at the beginning but after enclosing all occurrence of %logfile% with “” (%logfile% -> “%logfile%”), it then worked perfect.


  2. How about using Dynamic AD Replication Checker Tool – An advanced tool for experienced AD Administrators at

  3. Hi – No problem at all.

    Dynamic AD Replication Checker Tool Version 2.0 has been released at

    Fixed a number of bugs reported by the users. Thanks Users!

    New Features supported in Version 2.0:

    Ø Monitor AD Replication based on schedules
    Ø Check and troubleshoot Replication issues for all or individual Domain Controllers
    Ø Check Orphaned Domain Controllers, if any
    Ø Individual Naming Context Replication Status
    Ø Easy navigation of Objects in Objects Pane
    Ø Execute Individual Columns
    Ø Populate Instance Groups in Object Pane
    Ø Add Site/DC Manually
    Ø Save Session in local database
    Ø Switch to Monitoring and Console Version at any time
    Ø Check Error or Warning Events on Domain controllers
    Ø Perform DNS Test, check SOA, NA, and Forwarders
    Ø DC Event Log Tests
    Ø DC Patch Status
    Ø Network Configuration on the Destination Domain Controllers
    Ø Easily check Status of Domain Controller Services
    Ø Check AD Pending Replication Jobs and Naming Contexts in Sync
    Ø 164 Dynamic Columns for Server Object available


  4. Great script, needed to make a few tweaks to suit my needs and environment. I can send my additions if you would like.

  5. Great tool! I didn’t need to modify the script. The report successfully generated as stated. Thank you!

Leave a Reply

Your email address will not be published.