Periodic domain controller (DC) health checks help administrators catch replication failures, DNS misconfigurations, and service outages before they affect authentication across the domain. Windows provides DCDiag, repadmin, and the Get-ADDomainController PowerShell cmdlet to run these checks. This article covers how to use each tool from an elevated PowerShell session, how to view DC information through Active Directory Users and Computers (ADUC), and how ADManager Plus provides centralized DC reporting without requiring command-line access.

Performing a DC health check using PowerShell

Prerequisites

• Permissions: Domain Admins membership is required to run DCDiag and repadmin with full output. Delegated accounts with read access to DC objects and the Replicating Directory Changes permission can run Get-ADDomainController queries but may have restricted access to some repadmin outputs.
• Tools: DCDiag and repadmin are available natively on domain controllers running Windows Server 2012 R2 and later. On workstations, install Remote Server Administration Tools (RSAT) to access both tools and the Active Directory module for Windows PowerShell.
• Session: All commands must be run from an elevated PowerShell window or elevated Command Prompt.

Steps to perform a DC health check via PowerShell

DCDiag and repadmin are command-line tools that can be called directly from an elevated PowerShell window. Get-ADDomainController is a native PowerShell cmdlet and requires the Active Directory module to be loaded.

1. Open PowerShell as an administrator.
2. Import the Active Directory module.
   Copy Import-Module ActiveDirectory
3. List all DCs in the domain to confirm which DCs are registered, along with their site membership, operating system, and IP address.
   Copy Get-ADDomainController -Filter *
4. Run the full default set of diagnostic tests against the local DC.
   Copy dcdiag
5. To run all DCDiag tests against every DC in the domain simultaneously, use the /e flag.
   Copy dcdiag /e
6. Review the replication summary for the domain, showing success and failure counts per DC and per naming context.
   Copy repadmin /replsummary
7. View per-partner replication status for a specific DC, including the last replication time and any error codes.
   Copy repadmin /showrepl <DC-FQDN>
8. Force replication across all DCs in the domain.
   Copy repadmin /syncall /Aped
9. List all five FSMO role holders across the domain and forest.
   Copy netdom query fsmo
10. Check the status of critical AD services on the local DC.
    Copy $services = 'Active Directory Domain Services', 'Kerberos Key Distribution Center', 'NetLogon', 'W32Time', 'DFS Replication' foreach ($svc in $services) { Get-Service -Name $svc | Select-Object Name, Status }

To target a specific health area, use DCDiag with the /test parameter. The examples below cover the most critical checks.

Check AD replication health

Runs only the replication test to identify DCs that have not received changes from their partners within the expected interval.

Verify DNS health and SRV record registration

Tests whether the DC has correctly registered its DNS A record and required SRV records, including _ldap._tcp and _kerberos._tcp.

Confirm required AD services are running

Checks that the services required for AD DS to function—including NTDS, Net Logon, and KDC—are running on the DC.

Verify DC advertising in DNS

Confirms the DC is correctly advertising itself in DNS and that other domain members can locate it through normal service location lookups.

Check Net Logon service permissions

Verifies that the Net Logon service has the permissions it needs to register DNS records and authenticate domain members.

Verify SYSVOL replication health

Checks that SYSVOL is being replicated correctly and that the SYSVOL and NETLOGON shares are accessible on the DC.

Test network connectivity to replication partners

Verifies that the DC can reach its replication partners over the network and that LDAP and RPC connections can be established.

Confirm FSMO role holder visibility

Tests whether the DC can locate all five FSMO role holders in the domain and forest.

Example 2: Enable all disabled computers in an OU in bulk

This retrieves all disabled computers in a specific OU and passes them through the pipeline to Enable-ADAccount:

Example 3: Enable computers from a CSV file in bulk

This reads a CSV file containing a sAMAccountName column and enables each listed computer account:

Example 4: Preview changes before enabling objects in bulk

This runs the operation in simulation mode using -WhatIf to show which accounts would be affected without making any changes:

Example 5: Enable a computer in a remote domain

This uses the -Server parameter to target a domain controller (DC) in a remote domain, with alternate credentials supplied via -Credential:

Supported parameters

Limitations for a DC health check via PowerShell

• DCDiag and repadmin produce plaintext output with no centralized dashboard, making it difficult to track health trends across a large number of DCs over time.
• Both tools must be run manually on demand; there is no built-in mechanism to schedule periodic health checks or trigger an alert when a test fails.
• Interpreting repadmin error codes and DCDiag failure output requires familiarity with AD replication architecture, which limits delegation to non-specialist staff.
• Running enterprise-wide checks with dcdiag /e across multiple sites can be slow and produces large volumes of text that must be reviewed manually.
• Neither DCDiag nor repadmin produces exportable compliance documentation; generating audit-ready records from native tool output requires additional scripting or manual formatting.

Viewing DC information using ADUC

Prerequisites for a DC health check via ADUC

• Permissions: Any domain account can open ADUC and browse the Domain Controllers OU. Viewing all DC object properties may require read access delegated on the Domain Controllers OU.
• Tools: ADUC is available on domain controllers and on machines with RSAT installed. Launch it by running dsa.msc or from Server Manager > Tools.

Steps to view DC information using ADUC

ADUC does not provide diagnostic health check capabilities for DCs. It allows administrators to browse the Domain Controllers OU and view the properties of individual DC computer objects, but it cannot run diagnostic tests, report replication status, check service states, or display FSMO assignments in a health context.

1. Open ADUC by running dsa.msc or launching it from Server Manager > Tools.
2. In the left pane, expand your domain and select the Domain Controllers OU.
3. The center pane displays the computer objects representing each registered DC in the domain.
4. Right-click a DC object and select Properties to view basic attributes stored in AD, such as the operating system version and DNS host name.

For replication status, service health, DNS validation, and FSMO role placement, DCDiag, repadmin, and netdom must be used from an elevated command session as described in the PowerShell section above.

Limitations for a DC health check via ADUC

• ADUC shows only a static list of DC computer objects in the Domain Controllers OU and cannot run diagnostics, report replication status, or check service states.
• There is no way to view FSMO role assignments, SYSVOL share availability, or DNS SRV record health from within the ADUC interface.
• ADUC provides no export capability for DC inventory data in a compliance-ready format.

Troubleshooting

1. DCDiag reports failed test replications

This failure indicates that the DC has not received directory changes from one or more replication partners within the expected interval. Run repadmin /showrepl <DCName> to identify which partner is failing and note the error code. Error 1722 (RPC server unavailable) points to a firewall or DNS resolution issue between replication partners. Error 8453 indicates that replication access was denied. Check the destination DC, the initiating account, and permissions on the affected naming context before attempting another sync. Resolve the underlying cause before forcing replication with /syncall.

2. repadmin /replsummary shows a high failure percentage

A high failure count usually means one or more DCs have been unreachable for an extended period or that a specific naming context has a persistent replication error. Run repadmin /showrepl * to get per-partner details across all DCs, verify that affected DCs are online and that their Active Directory Domain Services (NTDS) service is running, and check whether the failures are concentrated on a single partner or spread across multiple.

3. DCDiag /test:DNS fails with missing or incorrect SRV records

When a DC is missing _ldap._tcp or _kerberos._tcp SRV records in the DNS zone, other domain members and DCs cannot locate it through normal AD service location. Restart the Net Logon service on the affected DC to force SRV record re-registration: run net stop netlogon followed by net start netlogon, then re-run dcdiag /test:DNS to confirm the records are present.

4. Get-ADDomainController returns no results or "Unable to contact the server"

This typically means the machine running the cmdlet cannot reach a domain controller over the network, or that DNS is not resolving the domain name correctly. Verify network connectivity to the domain, confirm that the DNS SRV records for the domain are present, and ensure the Active Directory Web Services (ADWS) service is running on the target DC.

5. DCDiag /test:Advertising fails

An advertising failure means the DC is not registering itself correctly in DNS or that the Net Logon service has stopped. Confirm that the Net Logon service is running on the affected DC, that its DNS A record and _ldap._tcp SRV records are present in the forward lookup zone, and that the DC's computer account in AD is not disabled.

6. repadmin /syncall reports could not be contacted for a specific DC

Verify the DC is online, that RPC Endpoint Mapper (port 135) and the required dynamic high-range ports are reachable from the replication source, and that the NTDS service is running on the target. If the DC has been offline beyond the tombstone lifetime of the domain (180 days by default in Windows Server 2008 and later environments), a standard sync cannot recover it and additional domain recovery steps are required.

FAQs

1. How do I run DCDiag against a specific remote DC?

Use the /s parameter to specify the target DC by host name: dcdiag /s:<DCName>. This can be combined with specific test flags—for example, dcdiag /s:<DCName> /test:DNS runs only the DNS test against that DC. To test all DCs in the domain simultaneously, use dcdiag /e. Both flags can be used from an elevated PowerShell session on any machine with RSAT installed.

2. How do I identify which DC holds a specific FSMO role?

Run netdom query fsmo from an elevated Command Prompt or PowerShell session. This returns all five FSMO roles—Schema Master, Domain Naming Master, PDC Emulator, RID Master, and Infrastructure Master—along with the DC holding each. For per-role queries using PowerShell, use Get-ADDomain | Select-Object PDCEmulator, RIDMaster, InfrastructureMaster for domain-level roles, and Get-ADForest | Select-Object SchemaMaster, DomainNamingMaster for forest-level roles.

3. How do I check whether SYSVOL is properly shared on a DC?

Run dcdiag /test:SysVolCheck to verify SYSVOL replication health and share availability. You can also run net share directly on the DC to confirm that both SYSVOL and NETLOGON appear in the output. If SysVolCheck fails, verify that the DFS Replication (DFSR) service is running on the affected DC, as modern environments use DFS Replication for SYSVOL propagation rather than the older FRS service.

4. How do I save DCDiag output to a file for later review?

Use the /f parameter to redirect DCDiag output to a text log file: dcdiag /f:<LogFilePath>. For example, dcdiag /e /f:C:\dcdiag-results.txt runs all tests domain-wide and saves the results to the specified file. This is useful for periodic health checks where output needs to be retained for comparison, incident review, or compliance documentation.

5. Can ADManager Plus replace DCDiag and repadmin?

ADManager Plus does not execute DCDiag or repadmin diagnostics. It provides AD computer reports, including the Domain Controllers report for DC inventory; supports scheduled report delivery; and enables help desk delegation for reporting tasks. Active diagnostic checks for replication health, DNS validation, and service status must still be performed using DCDiag and repadmin, which require an elevated session on a DC or a machine with RSAT installed.

Simplify AD bulk management and reporting with ADManager Plus

Try it now for free