Active Directory

Health check

dcdiag /e /q                       # all DCs, errors only. Clean output = healthy
dcdiag /s:DC01 /v /c > dcdiag.txt  # full verbose test of one DC, to a file
repadmin /replsummary              # replication summary: fails / total, largest delta
repadmin /showrepl                 # per-partner detail for this DC
repadmin /queue                    # pending inbound replication
netdom query fsmo                  # which DC holds which FSMO role

In repadmin /replsummary, largest delta is the time since the last successful replication. Anything in the fails column, or a delta above about an hour on a LAN, needs a look.

Force replication everywhere:

repadmin /syncall /AdeP

Find where a lockout comes from

Lockouts are recorded as event 4740 on the PDC emulator. This reads them and shows the computer that sent the bad password:

$pdc = (Get-ADDomain).PDCEmulator
Get-WinEvent -ComputerName $pdc -FilterHashtable @{LogName='Security'; Id=4740} |
  Select-Object TimeCreated,
    @{n='User';  e={$_.Properties[0].Value}},
    @{n='Source';e={$_.Properties[1].Value}}

Then check that source computer for stale saved credentials, mapped drives, services or scheduled tasks running as the user, or a phone with an old password.

Search-ADAccount -LockedOut | Select-Object Name, SamAccountName
Unlock-ADAccount -Identity jsmith

Microsoft Account Lockout and Management Tools (LockoutStatus.exe) is old but still shows bad-password counts per DC at a glance.

Netlogon debug logging

When the source is still unclear, turn on Netlogon logging on the DCs:

nltest /dbflag:0x2080ffff          # on
# reproduce the lockout, then read %windir%\debug\netlogon.log
nltest /dbflag:0x0                 # off again, the log grows quickly

Enabling debug logging for the Netlogon service (Microsoft)

Time sync

Domain members sync to DCs and DCs sync to the PDC emulator. Only the PDC emulator should point at an outside source:

# On the PDC emulator only
w32tm /config /manualpeerlist:"time.windows.com,0x8 pool.ntp.org,0x8" /syncfromflags:manual /reliable:yes /update
Restart-Service w32time
w32tm /query /status               # check source and last sync, on any machine

SYSVOL: migrate FRS to DFSR

Domains created on Server 2003 or earlier may still replicate SYSVOL with FRS. Server 2019 and later DCs cannot be promoted into such a domain, so check first:

dfsrmig /getglobalstate            # "Eliminated" = already on DFSR, nothing to do

If not, step through the states, waiting for every DC to reach each one before moving on:

dfsrmig /setglobalstate 1          # Prepared
dfsrmig /getmigrationstate         # repeat until all DCs report it
dfsrmig /setglobalstate 2          # Redirected
dfsrmig /getmigrationstate
dfsrmig /setglobalstate 3          # Eliminated (no going back after this)
dfsrmig /getmigrationstate

Run a clean dcdiag and repadmin /replsummary before starting.

• Migrate SYSVOL replication to DFS Replication (Microsoft)
• Guide to migrate FRS to DFSR using dfsrmig (MCS Support)