Performing and Active Directory Health Check

There are a few Microsoft diagnostic tool you can run to do basic Active Directory health check.

dcdiag.exe is an utility that will run diagnostic tests against domain controllers. Here is a very good article Ned which I am not going to repeat here. This Technet article documented how this tool can be used with all the switches and results.

dcdiag.exe /v
dcdiag.exe /test:topology
dcdiag.exe /test:replications

The Microsoft I.T Environment Health Scanner is really good.  It has some A.D component in there as well and does all the jobs for you.
http://www.microsoft.com/download/en/details.aspx?id=10116

PD TechGuru Reference:
https://pdtechguru.wordpress.com/2012/10/04/active-directory-health-check/


DNS
DNS is a very important role in Active Directory and should be check first, if DNS is not working properly, you will most likely would have A.D. issues.
http://technet.microsoft.com/en-us/library/cc755349(WS.10).aspx

Some tools that is useful when troubleshooting DNS server issues:
1. DNSLint - http://support.microsoft.com/kb/321045
DNSlint /ad domain_controller_ip /s dns_server_ip

2. DNSCMD.EXE
/info will give you basic information about the DNS.
/zoneinfo <zone_name> display information about the zone.

A.D Replication
The following tools are useful for finding out replication status with A.D.

1. Repadmin.exe admin tool. http://technet.microsoft.com/en-us/library/cc755360(WS.10).aspx
/showrepl
/replsummary


2. dsastat -s:domaincontroller1;domaincontroller2This utility is useful in verifying replication between DCs to ensure that objects been completely replicated throughout the domain.

3. Replmon.exe GUI interface

Good to know:
To determine the FSMO Role.
- Netdom -query fsmo (list the current DC which holes the FSMO roles)
- dsquery server -hasfsmo schema/name/infr/rid/pdc
- dcdiag /test:knowsofrolesholders /v (including test as well..)

To Transfer or Seize FSMO Role.
Use ntdsutil to transfer the role
- Type roles
- connections
- connect to server <domain_controller> where the dc is where you want to transfer to
- quit
- transfer schema master
- quit

User ntdsutil to seize the role if you have lost the original DC for the role.
- follow the steps above but instead of transfer, you specify seize schema master for example.
- One the role is seize, do not attempt to bring the previous role owner up, it will cause the database to be corrupted.

Enable Netlogon logging.
- http://support.microsoft.com/kb/109626
- nltest /dbflag:0x2080ffff

Troubleshooting Replication issues:
http://technet.microsoft.com/en-us/library/cc755349(WS.10).aspx#BKMK_2

Display Information about previous logons during user logon - Windows 7

When Windows Active Directory been raised to Windows 2008 domain functional level. you can specify a group policy settings to display information about previous logon. This is a good feature to have especially if you are really security fanatic guy and want to know if your domain account's been compromise in any sense.

The group policy setting is at:
Computer Configuration | Administrative Templates | Windows Components | Windows Logon Options

Display information about previous logons during user logon : Enabled.


Things to watch out for. 

1.  The domain controller will need to have this same setting set to "enabled" before the workstation get the policy otherwise you will get a nasty information like "Security policies on this computer are set to display information about the last interactive login.  Windows could not retrieve this information" and could never login to the domain.

2.  If you have a screen logout policy in place which lock the screen every 15 mins of inactivity, eveytime you hit Control-Alt-Delete to login to the domain, you will be presented with these logon information, user account attributes will be updated and the domain controller will be working extremely hard to replicate these information between each other.  I find this put a lot of load on the DC and really annoying at times.

3.  The registry settings is at : [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"DisplayLastLogonInfo"=dword:00000001

So, if you decided to rollback this settings and disabled the group policy on the domain controller and workstation but your user still getting the nasty information and not able to login.  Most likely you will need to login as local admin and delete this registry key.

Reference:  http://blogs.dirteam.com/blogs/jorge/archive/2008/02/10/showing-last-logon-info-at-logon-in-windows-server-2008.aspx