Testing Active Directory Domain Controllers Using DcDiag.exe

Testing the health of your local domain controller can be an extremely important task, especially when problems with Active Directory arise. Let’s look at an important tool in the toolbelt for Active Directory administrators called DCDiag. It allows admins to check domain controller health and other metrics to ensure everything works properly in Active Directory Domain Services (AD DS).

Common Active Directory Errors and Issues

DcDiag can be very helpful when you need to quickly identify many common AD config and operational problems.

DNS Registration Failures

AD relies heavily on DNS. Missing/incorrect SRV, A, or CNAME records can prevent DCs from locating each other and may cause authentication, replication, and logon issues.

Replication Errors

Replication failures between DCs can lead to inconsistent AD data across the environment. DcDiag can help you to identify replication problems that may affect user accounts, Group Policy, and directory updates.

NetLogon Failures

The NetLogon service is responsible for DC registration and secure communication within AD. In case NetLogon is not functioning correctly, you may face a fail during DC discovery and authentication processes.

FSMO Role Connectivity Issues

DCs must be able to communicate with FSMO role holders. Keep in mind that connectivity problems can affect operations (such as RID allocation, time sync, and domain-wide admin tasks).

SYSVOL Replication Problems

SYSVOL contains Group Policy objects and logon scripts that must be replicated to all DCs. Note that replication problems can result in missing/outdated Group Policy settings across the domain.

Modern AD environments use DFS Replication (DFSR) for SYSVOL replication. While DCDiag can identify symptoms of SYSVOL replication problems, DFSR-specific troubleshooting often requires additional tools and logs.

Here are the common DFSR troubleshooting commands:

dfsrdiag replicationstate

dfsrdiag backlog

wmic /namespace:\\root\microsoftdfs path dfsrreplicatedfolderinfo get replicationgroupname,state

Note. WMIC is deprecated and may not be installed by default on newer versions of Windows Server/Windows 11. On Windows Server 2025, WMIC is available as a Feature on Demand and you need to install it manually.

The DFSRMIG tool allows you to check the current SYSVOL migration state (note that incomplete/stalled FRS-to-DFSR migrations can cause SYSVOL replication and Group Policy issues):

dfsrmig /getmigrationstate

dfsrmig /getglobalstate

You should also review the DFS Replication event log for replication errors and backlog issues.

Secure Channel Failures

Broken secure channels between DCs can cause authentication and replication problems. DcDiag can help you to identify trust and communication problems that require further investigation.

DCDiag commands

Note. FRS-based SYSVOL replication is deprecated. In modern AD environments you should use DFS Replication (DFSR) instead.

DCDiag syntax

The general syntax of the DcDiag utility is:

dcdiag [/s:<DomainController>] [/n:<NamingContext>] [/u:<Domain>\<UserName> /p:{* | <Password> | ""}] [{/a | /e}] [{/q | /v}] [/i] [/f:<LogFile>] [/c [/skip:<Test>]] [/test:<Test>] [/fix] [{/h | /?}] [/ReplSource:<SourceDomainController>]

Useful Examples of DcDiag Command

It is recommended to run the DcDiag test on the domain controller itself, and not remotely. For example, let’s run a check on a DC01 domain controller:

dcdiag /s:DC01

By default, DcDiag runs a standard set of DC diagnostic tests. Note that the exact number of tests may vary (it depends on the Windows Server version and installed roles). In our example, it is clear that all tests passed successfully (Starting test: …. passed test). It means that everything is fine on this DC.

The test results will show Passed if the test was successful and DcDiag found no errors. The Failed message will appear next to the check name if an error is found.

Hint. Note that you are likely to encounter warning events when running DcDiag tests remotely. Tests such as SystemLog will fail unless you run dcdiag.exe locally on a domain controller.

General health check

DcDiag allows you to perform a quick general health test of Active Directory and domain controllers. To check all DCs in the domain, use the /e parameter. The following command will only list errors that require the AD administrator’s attention:

dcdiag /e /q

The following command runs a more comprehensive set of tests than the default DCDiag execution:

dcdiag /c

The command below displays detailed information for each test:

dcdiag /c /v

Verifying AD Replication

While DCDiag validates the overall health of DCs, Repadmin provides detailed AD replication diagnostics. Here are the commands you need:

repadmin /replsummary

repadmin /showrepl

repadmin /showrepl *

repadmin /queue

You can use these commands to identify replication failures, replication latency, and communication problems between DCs. Note that you should always check replication health when troubleshooting AD problems.

repadmin /queue displays pending replication operations waiting to be processed by the DC.

Note that you should use repadmin /showrepl for a specific DC and repadmin /showrepl * only in case you need replication details from all DCs.

Recommended AD Health Check

For routine AD monitoring, you can use the following commands to quickly identify DC and replication issues:

dcdiag /e /q
dcdiag /test:DNS
repadmin /replsummary
Get-ADReplicationFailure -Scope Forest
dfsrmig /getmigrationstate

The migration state should be Eliminated (Global State 3) and all DCs should report that they have reached the target state.

Note. In large enterprise forests with dozens/hundreds of DCs, the /e switch may take considerable time to complete and can generate a large amount of output. You should consider targeting specific domains, sites, or DCs when troubleshooting localized issues.

Here are the key notes:

• dcdiag /e /q — runs diagnostics against all DCs in the forest;
• dcdiag /test:DNS — validates DNS registration, SRV records, dynamic updates, and other DNS-related issues that commonly affect AD authentication and replication.
• repadmin /replsummary — provides a replication health summary across all DCs;
• Get-ADReplicationFailure -Scope Forest — lists AD replication failures detected in the forest.
• dfsrmig /getmigrationstate — verifies the current SYSVOL migration state and helps you to identify incomplete/stalled FRS-to-DFSR migrations.

Running these commands regularly can help you to detect AD health problems before they impact users/services.

Specific tests

You can perform a specific AD test only by specifying its name, for example:

dcdiag /s:DC01 /a /test:NetLogons

Testing the RID master

You can test the health of the RID master FSMO owner in the domain:

Dcdiag.exe /TEST:RidManager /v

Performing a specific test from the checklist

Or you can exclude a specific test from the checklist:

dcdiag /s:DC01 /a /skip:Replication

Specifying credentials

When launching the DcDiag tool remotely, you need to specify the credentials with the domain admin privileges:

dcdiag /s:DC01 /u:CONTOSO\contosoadmin /p:*

The * character prompts for the password securely instead of exposing it in the command history.

Saving the Results to a File

In order to display the extended information and save the test results to files, use the command:

dcdiag /s:DC01 /v /f:c:\ps\dcdiag_report.log

Testing all Domain Controllers in the Current Site

To test all domain controllers in the current Active Directory site, run the command:

dcdiag /s:DC01 /a

Remove Extra Information

If you want to remove the extra information from the test results to display only the errors found, use the /q parameter (if no errors were found, the command will return nothing):

dcdiag /s:DC01 /q

Fixing Errors with DCDIag

The /fix switch has very limited functionality and is primarily used with the MachineAccount test to correct certain DC service principal name (SPN) registration issues. Most AD replication, DNS, SYSVOL, DFSR, and config problems still require manual remediation. Here is the command to use the /fix switch:

dcdiag /s:DC01 /fix

Re-register DNS Records After Fixing DNS Issues

In environments where DCDiag reports DNS registration problems, you may need to manually refresh DNS registrations after running the /fix option:

ipconfig /registerdns

net stop netlogon
net start netlogon

nltest /dsregdns

The ipconfig /registerdns command forces the DC to re-register its DNS records. Keep in mind that restarting the NetLogon service triggers registration of the domain controller’s SRV records in DNS. The nltest /dsregdns command can also be used to force a DC to register its DNS records, including SRV records required for DC discovery and AD services.

After performing these steps, you need to rerun the DNS diagnostics to check if the registration issues have been resolved:

dcdiag /test:DNS

The following command is one of the most useful DNS tests when troubleshooting missing SRV records and DC discovery issues:

dcdiag /test:DNS /DnsRecordRegistration

Testing Active Directory Domain Controllers using DCDiag

Using the DNS tests, you can perform primary tests testing server name resolution service in AD. For example, to run all DNS tests for a specific domain controller and export the result to a text file:

DCDiag /Test:DNS /e /v /s:dc01.theitbros.com >c:\logs\DcdiagDNSCheck.txt

Open the resulting DNS test log file:

Get-Content c:\logs\DcdiagDNSCheck.txt

The result of each DNS test is listed in a column under the “Summary of DNS test results” section. In this example, all DNS tests passed successfully (PASS), except for the DNS forwarding test (FAIL):

You can only run certain DNS tests:

dcdiag /test:DNS [/DnsBasic | /DnsForwarders | /DnsDelegation | /DnsDynamicUpdate | /DnsRecordRegistration | /DnsResolveExtName [/DnsInternetName:<InternetName>] | /DnsAll] [/f:<LogFile>] [/x:<XMLLog.xml>] [/xsl:<XSLFile.xsl> or <XSLTFile.xslt>] [/s:<DomainController>] [/e] [/v]

Here are the most commonly used DNS Tests:

dcdiag /test:DNS
dcdiag /test:DNS /DnsBasic
dcdiag /test:DNS /DnsRecordRegistration

Note that DnsRecordRegistration is especially useful when you need to troubleshoot missing SRV records and DC discovery problems.

Note that DNS issues are one of the most common causes of AD authentication, replication, and DC discovery problems. As a best practice, you should include DNS testing as part of your regular AD health checks. The /test:DNS option runs a comprehensive set of DNS diagnostics, while /DnsBasic performs a quicker validation of core DNS functionality.

Wrapping up

DCDiag should be one of the first tools used when troubleshooting AD issues. However, DCDiag alone does not provide a complete picture of AD health. You should use DCDiag together with Repadmin, DFSRDiag, Event Viewer, DNS diagnostics, and PowerShell AD replication cmdlets for comprehensive AD health monitoring to effectively troubleshoot replication, authentication, and DC issues.

dcdiag