102 lines
4.0 KiB
PowerShell
102 lines
4.0 KiB
PowerShell
# Script to validate an Active Directory Domain Controller's operational status
|
|
# Requires: ActiveDirectory PowerShell module and Domain Admin / Account Operator privileges
|
|
|
|
# Ensure AD Module is available
|
|
if (-not (Get-Module -ListAvailable -Name ActiveDirectory)) {
|
|
Write-Error "The ActiveDirectory module is required to run this script. Please install RSAT."
|
|
exit
|
|
}
|
|
|
|
# Set the target domain controller name
|
|
$DCName = Read-Host "Enter the Domain Controller Name (FQDN or Hostname)"
|
|
|
|
try {
|
|
# Check if the DC is online and retrievable
|
|
Write-Host "Verifying Domain Controller existence..." -ForegroundColor Cyan
|
|
$DC = Get-ADDomainController -Identity $DCName -ErrorAction Stop
|
|
Write-Host "Domain Controller '$DCName' found online." -ForegroundColor Green
|
|
|
|
---
|
|
|
|
# Test Critical Services (Replaces the invalid Test-ComputerSecureChannel logic)
|
|
Write-Host "`nChecking Critical AD Services..." -ForegroundColor Cyan
|
|
$CriticalServices = @("NTDS", "Netlogon", "SamSs", "W32Time", "DNS")
|
|
try {
|
|
$Services = Get-Service -ComputerName $DCName -Name $CriticalServices -ErrorAction Stop
|
|
foreach ($Service in $Services) {
|
|
if ($Service.Status -eq "Running") {
|
|
Write-Host " Service $($Service.Name) is Running." -ForegroundColor Green
|
|
} else {
|
|
Write-Warning " Service $($Service.Name) is $($Service.Status)!"
|
|
}
|
|
}
|
|
} catch {
|
|
Write-Warning "Failed to query services on '$DCName'. Check RPC/firewall settings."
|
|
}
|
|
|
|
---
|
|
|
|
# Check DNS Registration
|
|
Write-Host "`nChecking DNS Registration..." -ForegroundColor Cyan
|
|
try {
|
|
$Test = Resolve-DnsName -Name $DC.ForceLogonDC -ErrorAction Stop
|
|
if ($Test) {
|
|
Write-Host "DNS registration is OK." -ForegroundColor Green
|
|
}
|
|
} catch {
|
|
Write-Warning "DNS resolution failed for '$DCName'."
|
|
}
|
|
|
|
---
|
|
|
|
# Check Replication Status
|
|
Write-Host "`nChecking Replication Status..." -ForegroundColor Cyan
|
|
try {
|
|
$ReplicationStatuses = Get-ADReplicationStatus -DomainController $DCName -ErrorAction Stop
|
|
$ReplFailures = 0
|
|
|
|
foreach ($Status in $ReplicationStatuses) {
|
|
# 0 indicates success in AD replication cycles
|
|
if ($Status.LastReplicationSuccess -eq 0 -or $Status.LastAttemptResult -eq "Success") {
|
|
continue
|
|
} else {
|
|
Write-Warning " Replication Link Failed: Partner ($($Status.Partner)) -> Result: $($Status.LastAttemptResult)"
|
|
$ReplFailures++
|
|
}
|
|
}
|
|
|
|
if ($ReplFailures -eq 0) {
|
|
Write-Host "All replication links are healthy." -ForegroundColor Green
|
|
}
|
|
} catch {
|
|
Write-Warning "Failed to check replication status. Ensure you have proper replication viewing permissions."
|
|
}
|
|
|
|
---
|
|
|
|
# Check Directory Services Event Logs for Errors
|
|
Write-Host "`nChecking Directory Services Event Logs (Last 10 Errors)..." -ForegroundColor Cyan
|
|
try {
|
|
# Changed to 'Directory Service' log as it is far more relevant to DC health than 'Application'
|
|
$ErrorEvents = Get-WinEvent -ComputerName $DCName -LogName "Directory Service" -MaxEvents 10 -FilterHashtable @{Level=2} -ErrorAction SilentlyContinue
|
|
if ($ErrorEvents) {
|
|
Write-Warning "Found Error Events in Directory Service Log:"
|
|
foreach ($Event in $ErrorEvents) {
|
|
Write-Host " Time: $($Event.TimeCreated)"
|
|
Write-Host " ID: $($Event.Id)"
|
|
Write-Host " Description: $($Event.Message.Substring(0, [Math]::Min(100, $Event.Message.Length)))..."
|
|
}
|
|
} else {
|
|
Write-Host "No recent error events found in Directory Service log." -ForegroundColor Green
|
|
}
|
|
} catch {
|
|
Write-Warning "Could not read Event Logs from '$DCName'."
|
|
}
|
|
|
|
Write-Host "`n========================================="
|
|
Write-Host "Health check completed for '$DCName'." -ForegroundColor Cyan
|
|
|
|
} catch {
|
|
Write-Error "A critical error occurred: $($_.Exception.Message)"
|
|
}
|