title | description | ms.topic | ms.date | ms.author | author | ms.custom | ms.contributor |
---|---|---|---|---|---|---|---|
dcdiag |
DCDiag is used to diagnose Active Directory domain controller health and as a troubleshooting tool by performing several network connectivity tests. |
reference |
11/14/2023 |
alalve |
orthomas |
template-how-to, team=cloud_advocates |
nedpyle |
Applies To: Windows Server 2022, Windows Server 2019, Windows Server 2016
DCDiag.exe
analyzes the state of domain controllers (DC) in a forest or enterprise and reports any problems to help in troubleshooting. As an end-user reporting program, DCDiag is a command-line tool that encapsulates detailed knowledge of how to identify abnormal behavior in the system.
By default, DCDiag is readily available if logged into a DC. An alternative method to access DCDiag is to install the Remote Server Administration Tools (RSAT) on your device. DCDiag must be ran with administrative rights from an elevated command prompt (CMD) or PowerShell.
DCDiag consists of a framework for executing tests and a series of tests to verify different functional areas of the system. This framework selects which DC is tested according to scope directives from the user, such as enterprise, site, or single server. Testing the overall connectivity and responsiveness of the DC includes verifying:
- The DC can be located in DNS
- The DC responds to Internet Control Message Protocol (ICMP) pings
- The DC allows Lightweight Directory Access Protocol (LDAP) connectivity by binding to the instance
- The DC allows binding to the AD RPC interface using the DsBindWithCred function.
Note
Blocking ICMP prevents DCDiag from functioning as intended. While blocking ICMP is recommended at the Internet-edge of your network, internally blocking ICMP traffic leads to administrative issues that break legacy group policies, black hole router detection, or inefficient MTU sizes due to lack of a discovery option. Troubleshooting tools such as ping.exe
or tracert.exe
are also affected.
dcdiag [/s:<DomainController>] [/n:<NamingContext>] [/u:<Domain>\<UserName> /p:{* | <Password> | ""}] [{/a | /e}] [{/q | /v}] [/i] [/f:<LogFile>] [/c [/skip:<Test>]] [/test:<Test>] [/fix] [{/h | /?}] [/ReplSource:<SourceDomainController>]
DCDiag uses the following parameters:
Parameter | Description |
---|---|
/s:<DomainController> |
Specifies the name of the server to run the command against. If this parameter isn't specified, the tests are run against the local domain controller. This parameter is ignored for DcPromo and RegisterInDns tests, which can only be run locally. |
/n:<NamingContext> |
Uses NamingContext as the naming context to test. You can specify domains in NetBIOS, Domain Name System (DNS), or distinguished name format. |
/u:<Domain> \<UserName> /p:{<Password> | ""} |
Uses Domain\UserName. DCDiag uses the current credentials of the user (or process) that is logged on. If alternate credentials are needed, use the following options to provide those credentials for binding with Password as the password: Use quotation marks ("") for an empty or null password. Use the wildcard character (*) to prompt for the password. |
/a | Tests all the servers on this AD DS site. |
/e | Tests all the servers in the enterprise. This overrides /a . |
/q | Quiet. Prints only error messages. |
/v | Verbose. Prints extended information. |
/fix | Affects the MachineAccount test only. This parameter causes the test to fix the Service Principal Names (SPNs) on the Machine Account object of the domain controller. |
/f:<LogFile> |
Redirects all output to a log file. |
/c | Comprehensive. Runs all tests except DCPromo and RegisterInDNS, including non-default tests. Optionally, you can use this parameter with the /skip parameter to skip specified tests.The following tests aren't run by default:
|
/h or /? | Displays help at the command prompt. |
/test:<Test> |
Runs this test only. The connectivity test can't be skipped with the /skip parameter. |
/ReplSource:<SourceDomainController> |
Tests the connection between the domain controller on which you run the command and the source domain controller. (This parameter is used for the CheckSecurityError test.) SourceDomainController is the DNS name, NetBIOS name, or distinguished name of a real or potential server that will be the source domain controller for replication, as represented by a real or potential connection object. |
The following table displays known tests that run by default unless specified otherwise.
Test | Description |
---|---|
Advertising | Checks whether each domain controller advertises itself in the roles that it should be capable of performing. This test validates that the public DsGetDcName function used by computers to locate domain controllers will correctly locate any DCs. This test fails if the Netlogon Service has stopped or failed to start. If the Key Distribution Key (KDC) service is stopped, the Advertising test fails since the flag returned from DsGetDcName won't include KDC. If port 88 over TCP and UDP is blocked on a firewall, the Advertising test will pass despite the KDC not being able to answer Kerberos tickets requests. |
CheckSDRefDom | Checks that all application directory partitions have appropriate security descriptor reference domains. This test uses LDAP and validates cross reference objects located in cn=partitions,cn=configuration,dc=<forest root domain> contain the correct domain names in their msDS-SDReferenceDomain attributes. |
CheckSecurityError | Test is not run by default. Performs various security checks for errors related to the security components of the DC, such as issues with the security policy or the security database using LDAP, RPC, RPC over SMB, and ICMP. It checks:
When the /ReplSource parameter is added, the partner also checks:
|
Connectivity | Verifies that the DSA and DNS are registered and reachable using LDAP and RPC. |
CrossRefValidation | Retrieves a list of naming contexts located in cn=partitions,cn=configuration,dc=<forest root domain> with their cross references and then validates them similar to the CheckSDRefDom test using LDAP. This test looks at the nCName, dnsRoot, nETBIOSName, and systemFlags attributes to:
|
CutoffServers | Tests AD replication to ensure there aren't DCs without working connection objects between partners. Any servers that can't replicate inbound or outbound from any DCs are considered “cut off” using the DsReplicaSyncAll function, which triggers replication on the DCs. Use the /e parameter with caution if there are poorly implemented WAN links that are kept clean using schedules. If a server can't be contacted or is unavailable to LDAP on the network, then it provides no error or test results, even if the /v parameter is specified. This test uses RPC. |
DcPromo | Tests against the server specified in the client DNS settings if the infrastructure meets the necessary requirements to promote your device to a DC. This test uses DNS on the network and checks:
The following arguments are required:
|
DFSREvent | This test validates the Distributed File System Replication (DFSR) service’s health by checking the DFSR event log warning and error entries from the past 24 hours. This test uses RPC and EventLog Remoting Protocol. |
DNS | Tests enterprise-wide DNS health checks using DNS, RPC, and WMI protocols. Not ran by default and must be explicitly requested. See DNS syntax. |
FrsEvent | Checks to see if there are errors in the File Replication Service (FRS) event log from the past 24 hours as failing replication of the SysVol share can cause policy problems. This test uses RPC and EventLog Remoting Protocol. |
Intersite | Checks for failures that would prevent or temporarily hold up intersite replication and predicts how long it would take for the KCC to recover. This test uses DRS functions to check for conditions that would prevent intersite AD replication within a specific site or all sites by:
The /a or /e parameter must be used as not providing a site would allow the test to run but skips actual testing. This test uses RPC over the network to test the replication aspects and asks registry connections to check for NTDS override entries. LDAP is also used to locate connection info. |
KccEvent | This test queries the KCC on the DC for errors and warnings generated in the Directory Services event log during the last 15 minutes. The 15-minute threshold is irrespective of the Repl topology update period (secs) registry value on the DC. If firewall rules are causing this test to fail, see KB2512643 that covers enabling those rules to allow the test to succeed. This test uses RPC along with the EventLog Remoting Protocol. |
KnowsOfRoleHolders | This test returns the DCs knowledge of the five Flexible Single Master Operation (FSMO) roles but doesn't check all DCs knowledge for consistency. Using the /e parameter provides data for comparison. This test uses RPC to return DSListRoles within the Directory Replication Service (DRS) functions. |
MachineAccount | Checks whether the machine account has properly registered and that the services are advertised using LDAP and RPC over SMB, including checking:
This test also has two repair options:
|
NCSecDesc | Checks permissions on all the naming contexts (such as Schema, Configuration, etc.) on the source DC to validate that replication and connectivity works between DCs. It makes sure that Enterprise Domain Controllers and Administrators groups have the correct minimum permissions, which is the same test performed within CheckSecurityError. This test uses LDAP. |
NetLogons | Validates that the user running DCDiag can connect to and read the SYSVOL and NETLOGON shares without any security errors. It also verifies that the Administrators, Authenticated Users, and Everyone group have the access this computer from the network privilege on the DC. |
ObjectsReplicated | Checks that the Machine Account and Directory System Agent (DSA) objects have replicated. Two objects are validated by default and that they exist in each DC and are up to date on all other DCs:
You can use the /objectdn:dn parameter with the /n:nc parameter to specify an additional object to check. This test is done using RPC with DRS functions. |
OutboundSecureChannels | This test doesn't run by default. It checks that secure channels exist from all of the domain controllers in the domain to the domains specified by the /testdomain parameter. The /nositerestriction parameter prevents DCDiag from limiting the test to the domain controllers in the site. |
RegisterInDNS | Tests whether the directory server can register the directory Server Locator DNS records. These records must be present in DNS in order for other computers to locate this directory server for the <Active_Directory_Domain_DNS_Name> domain. This also reports if any modifications to the existing DNS infrastructure are required. The parameter /DnsDomain :<Active_Directory_Domain_DNS_Name> must be used. This test checks:
|
Replications | This test checks all AD replication connection objects for all naming contexts on specified DC(s) if:
|
RidManager | Checks whether the relative identifier (RID) master is accessible and if:
The role holder must be online and accessible for DCs to be able to create security principals (users, computers, and groups) as well as for further DCs to be promoted within a domain. This test uses LDAP and RPC. |
Services | This test validates that various AD-dependent services are running, accessible, and set to specific start types. These services start automatically and run in a shared process unless specified otherwise:
These service names are listed in the registry path HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services. This test uses RPC and the Service Control Manager remote protocol. |
SysVolCheck | This test reads the DCs Netlogon SysVolReady registry key to validate that SYSVOL is ready. The value name has to exist with a value of 1 to pass this test and works with either FRS or DFSR replicated SYSVOLs. It doesn’t check if the SYSVOL and NELOGON shares are accessible as this is performed by CheckSecurityError. This test uses RPC over SMB. |
SystemLog | Validates the System Event Log’s health by reading and writing entries from the past 60 minutes for any errors and warnings. This test uses RPC and the Service Control Manager remote protocol. |
Topology | Checks that the generated AD replication topology is fully connected for all DSAs. This test isn't performed by default and must be ran explicitly. It checks:
This test uses RPC, LDAP, and DsReplicaSyncAll with the flag DS_REPSYNCALL_DO_NOT_SYNC, meaning that it analyzes and validates replication topology without actually replicating changes. This test doesn't validate the availability of replication partners. Having a partner offline won't cause failures in this test. It also doesn't test if the schedule is closed, preventing replication. To see those active replication results, use tests Replications or CutoffServers. |
VerifyEnterpriseReferences | Checks that specified system references are intact for the FRS and replication infrastructure across all objects in the enterprise on each domain controller. This includes the following DC site attributes and objects:
The two DFSR tests are only performed if domain functional level is Windows Server 2008 or higher. This means there will be an expected failure if DFSR hasn't been migrated to SYSVOL. This test uses LDAP and only the specified DCs are contacted. |
VerifyReferences | Checks that certain system references are intact for the FRS and replication infrastructure. This test verifies computer reference attributes for a single DC, including the following DC site attributes and objects:
This test uses LDAP and is similar to the VerifyEnterpriseRefrences test except that it doesn't check partition cross references or all other DC objects. |
VerifyReplicas | Checks that all application directory partitions are fully instantiated on all replica servers. It verifies that the specified server hosts the application partitions specified by its crossref attributes in the partitions container. It operates like CheckSDRefDom except that it doesn't show output data and validates hosting. This test uses LDAP. |
Note
Connectivity checks on domain controllers that are registered on the network and connect with other resources like DNS, LDAP, and RPC can't be skipped.
dcdiag /test:DNS [/DnsBasic | /DnsForwarders | /DnsDelegation | /DnsDynamicUpdate | /DnsRecordRegistration | /DnsResolveExtName [/DnsInternetName:<InternetName>] | /DnsAll] [/f:<LogFile>] [/x:<XMLLog.xml>] [/xsl:<XSLFile.xsl> or <XSLTFile.xslt>] [/s:<DomainController>] [/e] [/v]
DNS test uses the following parameters:
Parameter | Description |
---|---|
/test:DNS | Performs the specified DNS test. If no test is specified, defaults to /DnsAll . |
/DnsBasic | Performs basic DNS tests, including network connectivity, DNS client configuration, service availability, and zone existence. |
/DnsForwarders | Performs the /DnsBasic tests and also checks the configuration of forwarders. |
/DnsDelegation | Performs the /DnsBasic tests and also checks for proper delegations. |
/DnsDynamicUpdate | Performs /DnsBasic tests and also determines if dynamic update is enabled in the Active Directory zone. |
/DnsRecordRegistration | Performs the /DnsBasic tests, and also checks if the address (A), canonical name (CNAME) and well-known service (SRV) resource records are registered. In addition, creates an inventory report based on the test results. |
/DnsResolveExtName [/DnsInternetName:\<InternetName> ] |
Performs the /DnsBasic tests, and also attempts to resolve InternetName. If /DnsInternetName isn't specified, attempts to resolve the name <www.microsoft.com>. If /DnsInternetName is specified, attempts to resolve the Internet name supplied by the user. |
/DnsAll | Performs all tests, except for the /DnsResolveExtName test, and generates a report. |
/f:<LogFile> |
Redirects all output to a log file. |
/s:<DomainController> |
Runs the tests against the domain controller. If this parameter isn't specified, the tests are run against the local domain controller. |
/e | Runs all tests specified by /test:DNS against all domain controllers in the Active Directory forest. |
/v | Verbose. Presents extended information about successful test results in addition to information about errors and warnings. When the /v parameter isn't used, provides only error and warning information. Use the /v switch when errors or warnings are reported in the summary table. |
/x:<XMLLog.xml> |
Redirects all output to xmllog.xml. This parameter works only with the /test:DNS option. |
/xsl:<XSLFile.xsl> or /xsl: <XSLTFile.xslt> |
Adds the processing instructions that reference the specified sheet. This parameter only works with the /test:DNS /x:<XMLLog.xml option. |
Note
Run times for DNS tests can be significant in large enterprises when the /e
parameter is used. Domain controllers and DNS servers that are offline will increase run times due to long time-out periods for RPC and other protocols.
To run a series of connectivity tests on the local domain, run the following command:
dcdiag
A successful connectivity test output:
Directory Server Diagnosis
Performing initial setup:
Trying to find home server...
Home Server = MapleWaffle-WS22
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: Default-First-Site-Name\MAPLEWAFFLE-WS2
Starting test: Connectivity
......................... MAPLEWAFFLE-WS2 passed test Connectivity
Doing primary tests
Testing server: Default-First-Site-Name\MAPLEWAFFLE-WS2
Starting test: Advertising
......................... MAPLEWAFFLE-WS2 passed test Advertising
Starting test: FrsEvent
......................... MAPLEWAFFLE-WS2 passed test FrsEvent
Starting test: DFSREvent
......................... MAPLEWAFFLE-WS2 passed test DFSREvent
Starting test: SysVolCheck
......................... MAPLEWAFFLE-WS2 passed test SysVolCheck
Starting test: KccEvent
......................... MAPLEWAFFLE-WS2 passed test KccEvent
Starting test: KnowsOfRoleHolders
......................... MAPLEWAFFLE-WS2 passed test KnowsOfRoleHolders
Starting test: MachineAccount
......................... MAPLEWAFFLE-WS2 passed test MachineAccount
Starting test: NCSecDesc
......................... MAPLEWAFFLE-WS2 passed test NCSecDesc
Starting test: NetLogons
......................... MAPLEWAFFLE-WS2 passed test NetLogons
Starting test: ObjectsReplicated
......................... MAPLEWAFFLE-WS2 passed test ObjectsReplicated
Starting test: Replications
......................... MAPLEWAFFLE-WS2 passed test Replications
Starting test: RidManager
......................... MAPLEWAFFLE-WS2 passed test RidManager
Starting test: Services
......................... MAPLEWAFFLE-WS2 passed test Services
Starting test: SystemLog
......................... MAPLEWAFFLE-WS2 passed test SystemLog
Starting test: VerifyReferences
......................... MAPLEWAFFLE-WS2 passed test VerifyReferences
Running partition tests on : ForestDnsZones
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... ForestDnsZones passed test CrossRefValidation
Running partition tests on : DomainDnsZones
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... DomainDnsZones passed test CrossRefValidation
Running partition tests on : Schema
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Running partition tests on : Configuration
Starting test: CheckSDRefDom
......................... Configuration passed test
CheckSDRefDom
Starting test: CrossRefValidation
......................... Configuration passed test
CrossRefValidation
Running partition tests on : corp
Starting test: CheckSDRefDom
......................... corp passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... corp passed test CrossRefValidation
Running enterprise tests on : corp.contoso.com
Starting test: LocatorCheck
......................... corp.contoso.com passed test
LocatorCheck
Starting test: Intersite
......................... corp.contoso.com passed test
Intersite
To run a series of connectivity tests on a specific domain controller, run the following command:
dcdiag /s:<DomainControllerName>
It should generate similar results as the local test if no issues are encountered.
DCDiag is able to save the output results to a text file by running:
dcdiag /s:<DomainControllerName> /f:<FileName.txt>
If no <FilePath>
is specified, results are saved to C:\Users\<UserName>\<FileName.txt>
by default.
To save to a specific location, run:
dcdiag /s:<DomainControllerName> /f:<DriveLetter>\<FilePath>\<FileName.txt>