DCDIAG Explained: 15 Active Directory Health Checks Every Admin Should Run

DCDIAG is one of the most useful Active Directory diagnostic tools for Windows administrators. It checks the condition of domain controllers and helps identify DNS, replication, services, SYSVOL, network, and directory configuration problems before they affect users.

Quick answer: Run dcdiag /v for detailed local domain-controller health, or use dcdiag /e /v to check domain controllers across the enterprise. Focus on failed tests first—especially DNS, Connectivity, Advertising, Replications, Services, and SystemLog.

What Is DCDIAG?
Most Useful DCDIAG Commands
15 Active Directory Health Checks
Example: Reading DCDIAG Results
Common DCDIAG Errors
Best Practices
FAQ

What Is DCDIAG?

DCDIAG, short for Domain Controller Diagnostic, is a built-in Windows Server command-line tool that analyzes domain controller health and reports problems. It can test a local DC, a specific remote DC, all DCs in a site, or every DC in the Active Directory enterprise.

Run it from an elevated Command Prompt or PowerShell session on a domain controller. You can also run it remotely when RSAT is installed and you have the required permissions.

Most Useful DCDIAG Commands

Command	Purpose
`dcdiag`	Runs the default diagnostic tests against the local domain controller.
`dcdiag /v`	Runs tests with detailed output.
`dcdiag /e /v`	Checks all domain controllers in the enterprise.
`dcdiag /test:DNS /v`	Runs detailed DNS diagnostics.
`dcdiag /test:Replications`	Checks Active Directory replication health.
`dcdiag /s:DC01 /v`	Tests one named domain controller.
`dcdiag /c /v /f:C:\Reports\dcdiag.txt`	Runs comprehensive tests and saves results to a file.

Important: Do not use /fix casually. It applies to the MachineAccount test and can modify service principal names (SPNs). Review the output and confirm the cause before changing production Active Directory objects.

15 Important Active Directory Health Checks in DCDIAG

1. Connectivity

What it checks: Whether the domain controller can be found in DNS and can communicate over ICMP, LDAP, and AD RPC.

Why it matters: If Connectivity fails, most other Active Directory functions can fail too.

Command: dcdiag /test:Connectivity /v

2. Advertising

What it checks: Whether the DC advertises itself as available for the roles it should perform.

Common cause of failure: Netlogon or KDC service problems.

Command: dcdiag /test:Advertising /v

3. DNS

What it checks: DNS client settings, DNS service availability, zones, dynamic updates, and important record registration.

Common cause of failure: A DC is using public DNS, missing SRV records, or has incorrect DNS zones.

Command: dcdiag /test:DNS /v

4. Replications

What it checks: Inbound AD replication attempts and replication errors.

Common cause of failure: DNS failures, RPC/firewall blocks, authentication issues, or offline replication partners.

Command: dcdiag /test:Replications /v

5. Services

What it checks: Whether essential Active Directory-related services are running.

Common cause of failure: Stopped AD DS, DNS, Netlogon, KDC, DFS Replication, or related services.

Command: dcdiag /test:Services /v

6. SystemLog

What it checks: System Event Viewer entries that could affect domain controller health.

Common cause of failure: Disk, network adapter, service, or driver problems.

Command: dcdiag /test:SystemLog /v

7. KccEvent

What it checks: Knowledge Consistency Checker events that affect replication topology.

Common cause of failure: Broken site links, unreachable DCs, or manually modified topology objects.

Command: dcdiag /test:KccEvent /v

8. NetLogons

What it checks: Netlogon share availability and DC locator behavior.

Common cause of failure: Netlogon service failure, DNS registration issues, or SYSVOL not being shared.

Command: dcdiag /test:NetLogons /v

9. SysVolCheck

What it checks: Whether the SYSVOL share is available.

Common cause of failure: DFS Replication or File Replication Service issues, incomplete SYSVOL initialization, or disk problems.

Command: dcdiag /test:SysVolCheck /v

10. DFSREvent

What it checks: DFS Replication event-log errors where DFSR is used for SYSVOL.

Common cause of failure: SYSVOL replication backlogs, DFSR database issues, or replicated-folder configuration problems.

Command: dcdiag /test:DFSREvent /v

11. FrsEvent

What it checks: File Replication Service events in environments that still use FRS.

Common cause of failure: Legacy SYSVOL replication errors.

Command: dcdiag /test:FrsEvent /v

12. MachineAccount

What it checks: The DC computer account, required service principal names, and directory attributes.

Common cause of failure: Missing SPNs, damaged DC computer-account properties, or incorrect DC object configuration.

Command: dcdiag /test:MachineAccount /v

13. KnowsOfRoleHolders

What it checks: Whether a domain controller can identify FSMO role holders.

Common cause of failure: Replication problems, stale role-holder references, or a failed FSMO role holder.

Command: dcdiag /test:KnowsOfRoleHolders /v

14. RidManager

What it checks: Communication with the RID Master and the ability to obtain RID pools.

Common cause of failure: RID Master outage or replication/connectivity trouble.

Command: dcdiag /test:RidManager /v

15. VerifyReferences

What it checks: Important Active Directory references used by replication infrastructure and SYSVOL-related objects.

Common cause of failure: Stale metadata, incomplete domain controller removal, or directory object corruption.

Command: dcdiag /test:VerifyReferences /v

Example: How to Read a DCDIAG Failure

If you see:

Starting test: DNS
DC01 failed test DNS

Do not assume the DNS server itself is broken. Run a deeper test first:

dcdiag /test:DNS /DnsRecordRegistration /v

Then verify that the DC is configured with internal DNS servers, its A and SRV records are present, and Netlogon is running. After correcting the problem, rerun the same test to confirm the result.

Common DCDIAG Problems and Fixes

DNS test failure: Check DNS client settings, AD-integrated zones, SRV records, and dynamic update configuration.
Replication test failure: Use repadmin /replsummary and repadmin /showrepl for the exact replication error.
Advertising test failure: Verify Netlogon and KDC services, DNS registration, and port 88 access.
SYSVOL or DFSR failure: Review DFS Replication event logs and make sure SYSVOL and NETLOGON shares are available.
MachineAccount failure: Review SPNs and DC account attributes before considering dcdiag /fix.

Pros and Cons of Using DCDIAG

Advantages

Built into Windows Server and widely available with RSAT.
Checks multiple domain-controller health areas quickly.
Can test one DC, a site, or the whole enterprise.
Provides detailed output that helps target the root cause.

Limitations

Output can be lengthy and confusing in large environments.
A failed test identifies a symptom, not always the root cause.
Enterprise-wide scans can take time when DCs are offline.
Some results depend on your SYSVOL replication setup and environment design.

DCDIAG Best Practices

Run dcdiag /v on every domain controller as part of routine health checks.
Save results to a dated report for trend comparison.
Use dcdiag /e /v carefully in large environments, as offline servers can increase runtime.
Review DCDIAG together with repadmin, Event Viewer, DNS Manager, and Active Directory Sites and Services.
Never apply automatic fixes or remove metadata without verifying the cause and confirming backups.
Add screenshots of your own tested output before publishing this guide for stronger technical trust.

Frequently Asked Questions

What does DCDIAG do?

DCDIAG checks domain controller health across areas such as DNS, network connectivity, services, replication, SYSVOL, event logs, FSMO role awareness, and directory references.

How do I run DCDIAG on all domain controllers?

Run dcdiag /e /v from an elevated Command Prompt or PowerShell session. The /e option tests domain controllers in the enterprise.

What is the difference between DCDIAG and Repadmin?

DCDIAG provides broad domain-controller health checks. Repadmin focuses more specifically on Active Directory replication status, partners, and errors. Use both tools together.

Is DCDIAG safe to run in production?

Yes, standard DCDIAG tests are read-only diagnostics. Use caution with options that can make changes, such as /fix, and only use them after reviewing the affected environment.

Table of Contents

What Is DCDIAG?

Most Useful DCDIAG Commands