Active Directory is a complex interaction of numerous networking services. When something goes wrong, you may not always know where the problem resides. Here is a quick reference you can use to determine which tools to use to help locate and resolve problems with your AD network.
- Is the network functioning at all? Can you view a list of networked systems or even access resources on other computers? If not, you have network connectivity problems. The troubleshooting tools you should start with include: Event Viewer, Ping, IPCONFIG, NLTEST, NetDiag and Network Monitor.
- Is name resolution functioning? Can you resolve NetBIOS or domain names into IP addresses using Windows Explorer or PING? If not, you have name resolution service problems. The troubleshooting tools you should start with include: Event Viewer, NSLOOKUP, NBTSTAT and DNSCMD.
- Is the domain controller functioning? Can a client log in and obtain its roaming profile? If not, your DC is having problems. The troubleshooting tools you should start with include: Event Viewer, DCDiag, DSASTAT and NTDSUTIL.
- Is authentication functioning? Can any client log on locally or remotely? If not, your DC is not authenticating properly. The troubleshooting tools you should start with include: Event Viewer and NetSetup.
- Is access control functioning as expected? Can you access objects that you should be granted access to, and are you restricted from objects that you should not have access to? If not, then your ACLs or your DC is not functioning properly. The troubleshooting tools you should start with include: Event Viewer, DSACLS, NETDOM and SDCHECK.
If you'd like more information on how to use these tools to track down an Active Directory problem on your network, consult Chapter 10 of the Windows 2000 Server Resource Kit titled "Active Directory Diagnostics, Troubleshooting, and Recovery".
James Michael Stewart is a researcher and writer for Lanwrights, Inc.