Domain controller health check: the commands every admin should know

Run on a domain controller (as admin)

# 1. Overall DC diagnostics (summary of failures only)
dcdiag /q

# 2. Replication summary across all DCs
repadmin /replsummary

# 3. Detailed inbound replication for this DC
repadmin /showrepl

# 4. DNS health for AD
dcdiag /test:dns /v /e > "$env:TEMP\dcdiag-dns.txt"

# 5. Who holds the FSMO roles
netdom query fsmo

# 6. All domain controllers and their sites
Get-ADDomainController -Filter * | Select-Object Name, Site, IPv4Address, OperatingSystem, IsGlobalCatalog

# 7. Key services running
Get-Service NTDS, DNS, Netlogon, KDC, W32Time | Select-Object Name, Status

What “healthy” looks like

• dcdiag /q returns nothing, or only warnings you understand.
• repadmin /replsummary shows 0 fails and a small largest delta.
• Every DC is a global catalog unless you have a reason otherwise.
• Time is in sync: the PDC emulator should sync from a reliable external source.

Common problems for new admins

• DNS misconfiguration: DCs pointing to public DNS instead of themselves or partner DCs.
• Old DCs never cleaned up: use metadata cleanup when a DC died and was never demoted.
• Firewall rules blocking RPC between sites.

Run this monthly, and after any DC change or outage.