ACTIVE DIRECTORY DEEP CORE
Active Directory Health Baseline and Maintenance Deep Core
Healthy Active Directory is mostly quiet. The job is to know what normal looks like before authentication or replication breaks.
Chapter purpose
Turn diagnostics from emergency commands into a repeatable health baseline.
Learning objectives
- Create a repeatable DC health checklist.
- Baseline replication and DNS health.
- Monitor time, disk, services and event logs.
- Separate maintenance from emergency repair.
Why this matters in a real company
Identity outages stop access to PCs, files, applications and administration. Routine health checks find drift before users become the monitoring system.
16.1 Check replication, DNS and time together
These three systems are tightly related. Replication failures can be caused by DNS or authentication/time problems, and DNS data itself may depend on AD replication.
Do not run a single command and declare the forest healthy.
dcdiag /e /c
repadmin /replsummary
w32tm /query /status
Get-ADDomainController -Filter * | Select HostName,Site,IPv4Address,IsGlobalCatalog16.2 Watch capacity and service state
Domain controllers still depend on ordinary server health: disk capacity, event logs, network adapters, virtualization host, backups and patching.
Low disk or broken DNS registration can become an identity incident even when NTDS service is technically running.
16.3 Review privileged and stale identities
Routine maintenance should include privileged-group review, disabled/stale accounts, unexpected service accounts and delegated-right ownership.
Do not delete stale objects blindly based only on age. Confirm ownership and business dependency.
16.4 Use an exception report
| Area | Healthy evidence | Escalate when |
|---|---|---|
| Replication | No unexpected failures | Repeated partner errors |
| DNS | SRV/DC records present | Missing/wrong records |
| Time | PDC hierarchy stable | Large drift/source wrong |
| Disk | Healthy free margin | Log/DB volume declining |
| Security | Privileged groups expected | Unknown member/delegation |
Quarterly review finds one branch DC with recurring replication failures
Users have not complained because another DC is reachable, but repadmin shows repeated failures for weeks.
Decision: Treat redundancy masking as a warning, not proof of health. Investigate network, DNS, site topology and server health during maintenance.
What to prove: Show root cause removed and a clean replication baseline over time.
Hands-on lab
Create a weekly AD health report in a lab using read-only commands. Save outputs with timestamps and compare two runs after a controlled DNS misconfiguration.
Troubleshooting exercise
- dcdiag reports many secondary errors. Find the earliest/root dependency.
- Replication failure is intermittent. Correlate time with WAN/network logs.
- Privileged group membership changed. Switch to audit investigation rather than routine maintenance.
Field checklist
- Replication baseline stored.
- DNS/SRV checked.
- Time hierarchy checked.
- Disk/event capacity monitored.
- Privileged groups reviewed.
- Backup/recovery status reviewed.
Chapter summary
Maintenance is not a long list of commands. It is a repeatable comparison between today's state and a known healthy baseline, followed by controlled remediation.
Current technical references
The supplied historical books are used as curriculum and operational context. Current implementation details are checked against current Microsoft documentation.