Active Directory Health Check: Comprehensive Diagnostic

<#
.SYNOPSIS
    Comprehensive AD Health Check — All Domain Controllers
.DESCRIPTION
    Runs DCDiag against every DC, generates a health report, and summarizes pass/fail counts
.NOTES
    Run from a domain-joined workstation with RSAT installed
#>
 
$ErrorActionPreference = 'Continue'
$ReportPath = "C:\BIN\LOGS-$(Get-Date -Format 'yyyy-MM-dd')-AD-HealthCheck.log"
 
# Get all Domain Controllers
$DCs = Get-ADDomainController -Filter * | Select-Object -ExpandProperty HostName
 
Write-Host "=== Active Directory Health Check ===" -ForegroundColor Cyan
Write-Host "Report: $ReportPath"
Write-Host "Domain Controllers: $($DCs.Count)"
Write-Host ""
 
# Run DCDiag on all DCs
foreach ($DC in $DCs) {
    Write-Host "Checking $DC..." -ForegroundColor Yellow
    dcdiag /s:$DC /v | Out-File -Append $ReportPath
}
 
# Summary
Write-Host ""
Write-Host "=== Summary ===" -ForegroundColor Green
Get-Content $ReportPath | Select-String "passed test|failed test" |
    Group-Object { $_ -match "passed" } |
    ForEach-Object {
        if ($_.Name -eq "True") { Write-Host "Passed: $($_.Count)" -ForegroundColor Green }
        else { Write-Host "Failed: $($_.Count)" -ForegroundColor Red }
    }

# Target specific DC — full verbose output
dcdiag /s:DC01.domain.local /v
 
# Essential tests only — faster execution
dcdiag /s:DC01.domain.local /test:services /test:replications /test:advertising /test:fsmocheck

# Quick replication summary for all DCs
repadmin /replsummary
 
# Detailed replication status per DC
repadmin /showrepl
 
# Find replication failures — this is the critical check
repadmin /showrepl * /csv | ConvertFrom-Csv |
    Where-Object { $_.'Number of Failures' -gt 0 } |
    Format-Table 'Source DSA', 'Destination DSA', 'Number of Failures', 'Last Failure Status'
 
# Force replication sync across all partitions
repadmin /syncall /AdeP
 
# Show pending replication queue
repadmin /queue

# Show all replication partners with last success time
Get-ADReplicationPartnerMetadata -Target * -Scope Domain |
    Select-Object Server, Partner, LastReplicationSuccess, LastReplicationResult |
    Format-Table -AutoSize
 
# Find partners with replication lag over 2 hours
Get-ADReplicationPartnerMetadata -Target * -Scope Domain |
    Where-Object { $_.LastReplicationSuccess -lt (Get-Date).AddHours(-2) } |
    Select-Object Server, Partner, LastReplicationSuccess

# Get all DCs
$DCs = (Get-ADDomainController -Filter *).HostName
$Domain = (Get-ADDomain).DNSRoot
 
foreach ($DC in $DCs) {
    Write-Host "DNS Check: $DC" -ForegroundColor Yellow
 
    # Verify A record resolves
    Resolve-DnsName $DC -Type A -ErrorAction SilentlyContinue
 
    # Verify critical SRV records exist
    Resolve-DnsName "_ldap._tcp.dc._msdcs.$Domain" -Type SRV
}
 
# Run DCDiag DNS-specific tests
dcdiag /test:dns /dnsdelegation
 
# Check DNS forwarders configuration
Get-DnsServerForwarder

# Check scavenging settings on DNS server
Get-DnsServerScavenging -ComputerName DC01
 
# Find stale records (older than 14 days)
Get-DnsServerResourceRecord -ZoneName "domain.local" -ComputerName DC01 |
    Where-Object { $_.Timestamp -and $_.Timestamp -lt (Get-Date).AddDays(-14) } |
    Select-Object HostName, RecordType, Timestamp |
    Format-Table -AutoSize

$DCs = (Get-ADDomainController -Filter *).HostName
 
foreach ($DC in $DCs) {
    $SYSVOLPath = "\\$DC\SYSVOL"
    $NETLOGONPath = "\\$DC\NETLOGON"
 
    Write-Host "Testing $DC..." -ForegroundColor Yellow
 
    if (Test-Path $SYSVOLPath) {
        Write-Host "  SYSVOL: OK" -ForegroundColor Green
    } else {
        Write-Host "  SYSVOL: FAILED" -ForegroundColor Red
    }
 
    if (Test-Path $NETLOGONPath) {
        Write-Host "  NETLOGON: OK" -ForegroundColor Green
    } else {
        Write-Host "  NETLOGON: FAILED" -ForegroundColor Red
    }
}
 
# Check DFS-R state
dfsrdiag.exe pollad

# Method 1: netdom
netdom query fsmo
 
# Method 2: PowerShell — more detail
$Forest = Get-ADForest
$Domain = Get-ADDomain
 
Write-Host "=== Forest-Wide Roles ===" -ForegroundColor Cyan
Write-Host "Schema Master: $($Forest.SchemaMaster)"
Write-Host "Domain Naming Master: $($Forest.DomainNamingMaster)"
 
Write-Host ""
Write-Host "=== Domain-Wide Roles ===" -ForegroundColor Cyan
Write-Host "PDC Emulator: $($Domain.PDCEmulator)"
Write-Host "RID Master: $($Domain.RIDMaster)"
Write-Host "Infrastructure Master: $($Domain.InfrastructureMaster)"
 
# Test FSMO connectivity
foreach ($FSMO in @($Forest.SchemaMaster, $Domain.PDCEmulator, $Domain.RIDMaster)) {
    $HostName = $FSMO.Split('.')[0]
    if (Test-Connection $HostName -Count 1 -Quiet) {
        Write-Host "$FSMO : Online" -ForegroundColor Green
    } else {
        Write-Host "$FSMO : OFFLINE" -ForegroundColor Red
    }
}

$ADServices = @(
    'NTDS',        # Active Directory Domain Services
    'DNS',         # DNS Server
    'Netlogon',    # Net Logon
    'DFSR',        # DFS Replication
    'W32Time',     # Windows Time
    'KDC'          # Kerberos Key Distribution Center
)
 
$DCs = (Get-ADDomainController -Filter *).HostName
 
foreach ($DC in $DCs) {
    Write-Host "=== $DC ===" -ForegroundColor Cyan
    foreach ($Service in $ADServices) {
        $Status = Get-Service -Name $Service -ComputerName $DC -ErrorAction SilentlyContinue
        if ($Status.Status -eq 'Running') {
            Write-Host "  $Service : Running" -ForegroundColor Green
        } else {
            Write-Host "  $Service : $($Status.Status)" -ForegroundColor Red
        }
    }
}

$StartTime = (Get-Date).AddHours(-24)
 
foreach ($DC in $DCs) {
    Write-Host "=== $DC - Last 24h Errors ===" -ForegroundColor Yellow
 
    Get-WinEvent -ComputerName $DC -FilterHashtable @{
        LogName = 'Directory Service', 'DNS Server', 'DFS Replication'
        Level = 2  # Error
        StartTime = $StartTime
    } -MaxEvents 10 -ErrorAction SilentlyContinue |
    Format-Table TimeCreated, Id, Message -Wrap
}

$DCs = (Get-ADDomainController -Filter *).HostName
 
foreach ($DC in $DCs) {
    # NTDS.dit database size
    $NTDSPath = "\\$DC\c$\Windows\NTDS\ntds.dit"
    if (Test-Path $NTDSPath) {
        $Size = (Get-Item $NTDSPath).Length / 1GB
        Write-Host "$DC NTDS.dit: $([math]::Round($Size,2)) GB" -ForegroundColor Cyan
    }
 
    # Log file accumulation (many logs = potential backup issues)
    $LogPath = "\\$DC\c$\Windows\NTDS\*.log"
    $LogCount = (Get-ChildItem $LogPath -ErrorAction SilentlyContinue).Count
    $Color = if ($LogCount -gt 10) { 'Yellow' } else { 'Green' }
    Write-Host "$DC Log Files: $LogCount" -ForegroundColor $Color
}

# Check time source on PDC Emulator
w32tm /query /source
 
# Check time offset against a DC
w32tm /stripchart /computer:DC01 /samples:5
 
# Force resync if needed
w32tm /resync /force
 
# Verify NTP configuration
w32tm /query /configuration