Overview of Active Directory Troubleshooting

On This Page

Overview Responding to Events Responding to Monitoring Alerts Responding to Symptoms Prerequisites for Troubleshooting Active Directory Problem Tracking Prerequisites Information About Your IT Environment Active Directory Concepts and Services Tools for Troubleshooting Active Directory

Overview

Active Directory directory service is a distributed system that is comprised of many different services and depends on all of the services to function properly. The methodology presented in this chapter can ease the difficulties inherent in identifying the computers and services involved in problems you might be having, and help you isolate a problem to the core component.

In most cases, troubleshooting begins when you detect one of the following:

• An event reported in an event log.

• An alert generated by a monitoring system, such as Microsoft Operations Manager (MOM).

• A symptom reported by a user or noticed by IT personnel.

This chapter includes troubleshooting procedures for the events, monitoring alerts, and symptoms that either have the highest frequency of occurrence or that can cause the greatest problem in your organization. Specific sections for each Active Directory service also include troubleshooting procedures for error messages generated by some tools that you might use in the troubleshooting process.

Responding to Events

When responding to events in the event logs, first determine the source that is listed in the event log, such as the Net Logon service or the File Replication service (FRS). Table 2.1 shows the event source and IDs, and references the troubleshooting sections for events that occur most frequently or that cause problems with the highest severity. If Table 2.1 does not include the event ID that you are looking for, search for it in the Microsoft Knowledge Base link on the Web Resources page at https://www.microsoft.com/windows/reskits/webresources.

Table 2.1 Active Directory Events Reference

Responding to Monitoring Alerts

As a best practice, use a comprehensive monitoring system for your environment. The alerts that monitoring systems generate vary. Table 2.2 shows some common alerts generated by Microsoft Operations Manager (MOM) with the Active Directory Management Pack (ADMP) installed and points you to the appropriate references for troubleshooting information.

If you are using a different monitoring system, look for the alert that most closely matches the alert generated by your system. If you do not find a monitoring alert in this table that you need information about, view the event logs and troubleshoot related error events that you find, or refer to further troubleshooting instructions in the section in this guide that most closely matches the problem reported.

Table 2.2 Active Directory Monitoring Alerts Reference

Responding to Symptoms

If you are troubleshooting Active Directory based on symptoms reported by users or noticed by IT personnel, you need to perform some preliminary troubleshooting steps to isolate the cause of the problem. See "High-Level Methodology for Troubleshooting Active Directory Problems" in this guide for information about how to iterate the troubleshooting process until you have found the root cause and resolved the problem.

If you have already determined the most likely source or cause of the problem, you can refer to the appropriate section in this guide, such as "Troubleshooting High CPU Usage on a Domain Controller" or "Troubleshooting Active Directory Replication Problems." Each section contains additional troubleshooting steps that allow you to further isolate the problem.

Prerequisites for Troubleshooting Active Directory

Before you begin troubleshooting Active Directory, ensure that you establish problem tracking prerequisites, review information about your IT environment, and become familiar with Active Directory concepts and services.

Problem Tracking Prerequisites

Have the following mechanisms in place to ensure timely problem detection, handling, and resolution:

• Service desk (or help desk)

• Incident and problem management processes

• Continuous monitoring software

For more information about implementing a service desk and incident and problem management processes within your organization, see the Microsoft Operations Framework (MOF) link on the Web Resources page at https://www.microsoft.com/windows/reskits/webresources. For more information about monitoring Active Directory, see "Monitoring Active Directory" in this guide.

Information About Your IT Environment

Ensure that the personnel performing Active Directory troubleshooting can easily access the following types of documentation:

• Active Directory configuration, including replication-related configuration documentation.

• Domain Name System (DNS), Dynamic Host Configuration Protocol (DHCP), and IP configurations.

• Application and service documentation (such as Exchange).

• Administrative model.

• Server placement and configurations.

• Change management logs.

Active Directory Concepts and Services

Ensure that the personnel performing the troubleshooting have at least a basic understanding of Active Directory concepts and services.

Active Directory Concepts

Active Directory concepts include the following areas:

• Name resolution, including both DNS and NetBIOS name resolution with broadcasts, LMHOSTS files, and Windows Internet Name Service (WINS).

• Replication (including Microsoft Windows 2000 Server native mode and Microsoft Windows NT 4.0 emulation).

• Time synchronization.

• Group Policy and File Replication service (FRS).

• Core Active Directory, including an understanding of the global catalog, domains, and forests.

• Authentication (both Kerberos authentication and LAN Manager).

• Active Directory Microsoft Management Console (MMC) snap-ins and Active Directory-related tools (including operating system, Support, and Resource Kit tools).

Active Directory Services

To discover the root cause of problems with Active Directory, ensure that the personnel performing troubleshooting understand common Active Directory operations like replication and password change and how the following processes and role holders are involved in these operations:

• Operations master roles (including PDC emulator, relative identifier (RID) master, domain naming master, schema master, and infrastructure master).

• Key Distribution Center (KDC).

• Knowledge Consistency Checker (KCC).

• Intersite Topology Generator (ISTG).

• Time Reference Server (TRS).

Because Active Directory interacts with external services and protocols, such as TCP/IP for the transport protocol, DNS for name resolution, and FRS for file replication of Group Policy objects and logon scripts, accurately determining the cause of a problem and applying a solution becomes more complex. Effective troubleshooting requires a thorough knowledge of these and other protocols, as well as the diagnostic tools associated with each protocol.

For more information about Active Directory®, networking protocols, and tools, see the Microsoft® Windows 2000 Server Resource Kit. You can obtain additional information by searching Microsoft.com and TechNet, or by taking advantage of MCSE training classes and books.

Tools for Troubleshooting Active Directory

Table 2.3 lists the tools that you can use to troubleshoot Active Directory, where the tools are found, and a brief description of the purpose of the tool.

For information about installing the Windows 2000 Support Tools and the Windows 2000 Administrative Tools Pack, see Windows 2000 Server Help.

Table 2.3 Tools Used to Troubleshoot Active Directory