Active Directory: Complete Configuration & Troubleshooting Guide

ACTIVE DIRECTORY
Complete Configuration & Troubleshooting
Guide
A to Z • From Installation to Advanced Troubleshooting

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

1. Introduction to Active Directory

Active Directory (AD) is Microsoft's directory service for Windows domain networks. It provides
authentication and authorization, storing information about network objects such as users,
computers, groups, and shared resources.

1.1 Core Concepts

Concept Description

Domain A logical grouping of network objects sharing a common directory

database
Forest A collection of one or more domains sharing a common schema
and global catalog
Tree A hierarchy of domains in the same forest sharing contiguous
namespace
Organizational Unit (OU) A container within a domain used to organize objects and apply
Group Policy
Global Catalog (GC) A distributed data repository containing a searchable, partial copy
of all objects in the forest
Schema Defines the structure and rules for objects stored in AD
Domain Controller (DC) A server that hosts a copy of the AD database and handles
authentication
FSMO Roles Five special roles that control critical operations within the
domain/forest
Trusts Relationships allowing users in one domain to access resources
in another
LDAP Lightweight Directory Access Protocol — the protocol used to
query and modify AD

1.2 FSMO Roles Reference

Flexible Single Master Operations (FSMO) roles are specialized domain controller tasks:

FSMO Role Scope Responsibility

Schema Master Forest-wide Controls changes to the AD schema

Domain Naming Master Forest-wide Controls adding/removing domains from the
forest

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

FSMO Role Scope Responsibility

PDC Emulator Domain-wide Password changes, time sync, GPO edits,

legacy NT compatibility
RID Master Domain-wide Allocates pools of relative identifiers to each DC
Infrastructure Master Domain-wide Maintains references to objects from other
domains

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

2. Prerequisites & Planning

2.1 Hardware Requirements
Component Minimum Recommended

CPU 1.4 GHz 64-bit 3.0 GHz+ multi-core

RAM 512 MB 4 GB+ (8 GB for busy DCs)
System Disk 32 GB 60 GB SSD
NTDS Disk Separate recommended Dedicated SSD volume
SYSVOL Disk Shared with OS is OK Separate volume preferred
Network 100 Mbps NIC 1 Gbps+ NIC with static IP

2.2 Pre-Installation Checklist

• Assign a static IP address to the server
• Configure DNS to point to itself ([Link] or loopback for the first DC)
• Set the hostname to the desired computer name before promotion
• Ensure the server is not already domain-joined (for first DC)
• Verify .NET Framework 4.x and PowerShell 5.1+ are installed
• Disable IPv6 only if it conflicts with your network infrastructure
• Synchronize time with an NTP source
• Verify no port conflicts on 53 (DNS), 88 (Kerberos), 389 (LDAP), 636 (LDAPS), 445
(SMB)

2.3 DNS Planning

Active Directory is tightly coupled with DNS. Poor DNS design is the #1 cause of AD issues.
• Use a private DNS namespace (e.g., [Link]) — avoid using public domain
names without delegation
• Avoid single-label domain names (e.g., 'corp') — they cause resolution issues
• Plan for at least two domain controllers with integrated DNS zones
• Ensure forward and reverse lookup zones exist and are AD-integrated

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

3. Installing Active Directory Domain Services

3.1 Install AD DS Role (PowerShell)
Run the following on Windows Server (PowerShell as Administrator):
# Install AD DS and management tools
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

# Verify the role was installed

Get-WindowsFeature -Name AD-Domain-Services

3.2 Promote to Domain Controller

Option A: New Forest (First DC)
Import-Module ADDSDeployment

Install-ADDSForest ``
-DomainName '[Link]' ``
-DomainNetBiosName 'CORP' ``
-ForestMode 'WinThreshold' ``
-DomainMode 'WinThreshold' ``
-InstallDns ``
-DatabasePath 'C:\Windows\NTDS' ``
-SysvolPath 'C:\Windows\SYSVOL' ``
-LogPath 'C:\Windows\NTDS' ``
-SafeModeAdministratorPassword (ConvertTo-SecureString 'P@ssw0rd!' -
AsPlainText -Force) ``
-Force

Option B: Additional DC in Existing Domain

Install-ADDSDomainController ``
-DomainName '[Link]' ``
-InstallDns ``
-Credential (Get-Credential) ``
-SafeModeAdministratorPassword (ConvertTo-SecureString 'P@ssw0rd!' -
AsPlainText -Force) ``
-Force

Option C: New Child Domain

Install-ADDSDomain ``

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

-NewDomainName 'child' ``
-ParentDomainName '[Link]' ``
-NewDomainNetBiosName 'CHILD' ``
-DomainMode 'WinThreshold' ``
-InstallDns ``
-Credential (Get-Credential) ``
-SafeModeAdministratorPassword (ConvertTo-SecureString 'P@ssw0rd!' -
AsPlainText -Force) ``
-Force

NOTE: After promotion the server will restart automatically. Allow 5-10 minutes for AD DS
to fully initialize before running any verification steps.

3.3 Post-Installation Verification

# Check AD DS service status
Get-Service ADWS, KDC, Netlogon, DFSR | Select Name, Status

# Confirm domain is reachable

Get-ADDomain
Get-ADForest

# Check replication status

repadmin /replsummary

# Check SYSVOL is shared

net share | findstr SYSVOL

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

4. User & Group Management

4.1 Creating User Accounts
# Create a single user
New-ADUser ``
-Name 'John Smith' ``
-GivenName 'John' ``
-Surname 'Smith' ``
-SamAccountName 'jsmith' ``
-UserPrincipalName 'jsmith@[Link]' ``
-Path 'OU=Employees,DC=corp,DC=contoso,DC=com' ``
-AccountPassword (ConvertTo-SecureString 'P@ssw0rd!' -AsPlainText -Force)
``
-PasswordNeverExpires $false ``
-ChangePasswordAtLogon $true ``
-Enabled $true

4.2 Bulk User Creation from CSV

# CSV format: Name,GivenName,Surname,SamAccountName,UPN,OU,Password
$users = Import-Csv -Path 'C:\[Link]'
foreach ($user in $users) {
New-ADUser -Name $[Link] -GivenName $[Link] ``
-Surname $[Link] -SamAccountName $[Link] ``
-UserPrincipalName $[Link] -Path $[Link] ``
-AccountPassword (ConvertTo-SecureString $[Link] -AsPlainText -
Force) ``
-Enabled $true
}

4.3 Group Types & Scopes

Type Scope Best Used For

Security Group Domain Local Granting permissions to resources in the same

domain
Security Group Global Organizing users in the same domain with similar
roles
Security Group Universal Granting access across multiple domains in a
forest

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

Type Scope Best Used For

Distribution Group Any Email distribution lists (no security permissions)

4.4 AGDLP / AGUDLP Best Practice

Follow the AGDLP nesting model for scalable permission management:
• A — Accounts (user accounts)
• G — Global Groups (organize users by role)
• DL — Domain Local Groups (assigned to resources)
• P — Permissions (applied to the resource)

BEST PRACTICE: For multi-domain forests, insert Universal Groups between Global and
Domain Local groups (AGUDLP). This reduces replication traffic across domain boundaries.

4.5 Common Group Management Commands

# Create a group
New-ADGroup -Name 'IT-Admins' -GroupScope Global -GroupCategory Security ``
-Path 'OU=Groups,DC=corp,DC=contoso,DC=com'

# Add members to a group

Add-ADGroupMember -Identity 'IT-Admins' -Members jsmith, abrown

# Get all members of a group (recursive)

Get-ADGroupMember -Identity 'IT-Admins' -Recursive | Select Name,
SamAccountName

# Find all groups a user belongs to

Get-ADPrincipalGroupMembership -Identity jsmith | Select Name

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

5. Organizational Units (OUs)

5.1 OU Design Principles
• Design OUs primarily for Group Policy application, not just organization
• Avoid nesting OUs more than 5 levels deep (performance and complexity issues)
• Separate OUs for computers and users allow different policies to apply
• Use geographic OUs at the top level, then departmental below (or vice versa depending
on GPO needs)
• Do not create OUs just for delegation if a flat structure meets GPO needs

5.2 Recommended OU Structure

Example structure for a mid-sized organization:
[Link]
├── _CORP (top-level managed OU)
│ ├── Users
│ │ ├── Employees
│ │ ├── Service Accounts
│ │ └── Contractors
│ ├── Computers
│ │ ├── Workstations
│ │ ├── Servers
│ │ └── Laptops
│ ├── Groups
│ │ ├── Security
│ │ └── Distribution
│ └── Service Accounts
└── Domain Controllers (built-in, leave as-is)

5.3 OU Management Commands

# Create OU
New-ADOrganizationalUnit -Name 'Employees' ``
-Path 'OU=Users,OU=_CORP,DC=corp,DC=contoso,DC=com' ``
-ProtectedFromAccidentalDeletion $true

# Move object to different OU

Move-ADObject -Identity 'CN=John Smith,OU=OldOU,DC=corp,DC=contoso,DC=com'
``
-TargetPath 'OU=Employees,OU=Users,OU=_CORP,DC=corp,DC=contoso,DC=com'

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

# Disable accidental deletion protection (required before deleting OU)

Set-ADOrganizationalUnit -Identity 'OU=OldOU,DC=corp,DC=contoso,DC=com' ``
-ProtectedFromAccidentalDeletion $false
Remove-ADOrganizationalUnit -Identity 'OU=OldOU,DC=corp,DC=contoso,DC=com'
-Recursive

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

6. Group Policy (GPO)

6.1 Group Policy Processing Order
GPOs are applied in the following order (last applied wins for conflicting settings):
1. Local Computer Policy
2. Site-level GPOs
3. Domain-level GPOs
4. OU GPOs (parent OUs first, then child OUs)

MEMORY AID: Remember the acronym LSDOU: Local, Site, Domain, Organizational Unit.
Child OU policies override parent OU policies when there are conflicts.

6.2 Creating & Linking GPOs

# Create a new GPO
New-GPO -Name 'Workstation-Security-Policy'

# Link GPO to an OU
New-GPLink -Name 'Workstation-Security-Policy' ``
-Target 'OU=Workstations,OU=Computers,OU=_CORP,DC=corp,DC=contoso,DC=com'

# Disable a GPO link (without unlinking)

Set-GPLink -Name 'Workstation-Security-Policy' ``
-Target 'OU=Workstations,OU=Computers,OU=_CORP,DC=corp,DC=contoso,DC=com'
``
-LinkEnabled No

6.3 GPO Filtering

Security Filtering
By default, GPOs apply to 'Authenticated Users'. To restrict:
# Remove Authenticated Users from scope
Set-GPPermission -Name 'Workstation-Security-Policy' -TargetName
'Authenticated Users' ``
-TargetType Group -PermissionLevel None

# Add specific group to scope

Set-GPPermission -Name 'Workstation-Security-Policy' ``

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

-TargetName 'Workstation-Admins' -TargetType Group -PermissionLevel

GpoApply

WMI Filtering
WMI filters allow GPOs to target specific hardware/OS configurations. Example filter to target
only Windows 10/11:
SELECT * FROM Win32_OperatingSystem WHERE Version LIKE '10.%'

6.4 Essential GPO Settings

Category Setting Recommended Value

Password Policy Minimum password length 12 characters minimum

Password Policy Password complexity Enabled
Password Policy Maximum password age 90 days (or use Fine-Grained)
Account Lockout Lockout threshold 5 invalid attempts
Account Lockout Lockout duration 30 minutes
Audit Policy Logon events Success and Failure
Audit Policy Account management Success and Failure
Security Options Interactive logon message Set legal banner
Windows Firewall Domain profile Enabled, block inbound
Windows Update Automatic updates Configure WSUS server

6.5 Forcing & Troubleshooting GPO

# Force immediate GPO refresh on local machine
gpupdate /force

# Force GPO refresh on remote machine

Invoke-GPUpdate -Computer 'WORKSTATION01' -Force

# Generate RSoP (Resultant Set of Policy) report

gpresult /H C:\[Link] /F

# Check which GPOs applied to a user on a computer

gpresult /R /USER corp\jsmith

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

7. DNS Configuration for Active Directory

7.1 AD-Integrated DNS Zones
Active Directory uses DNS-integrated zones stored in the AD database. These replicate
automatically with AD replication, provide secure dynamic updates, and support
aging/scavenging.
• Forward Lookup Zone: Resolves hostnames to IP addresses (e.g.,
[Link] -> [Link])
• Reverse Lookup Zone: Resolves IP addresses to hostnames (e.g., [Link] ->
[Link])
• Zone replication scope: 'All DNS servers in this forest' is recommended for maximum
redundancy

7.2 Critical DNS Records

Record Type Example Purpose

A server01 -> [Link] Host name to IP mapping

PTR [Link] -> Reverse DNS lookup
[Link]
SRV _ldap._tcp.[Link] Locates LDAP service (domain
controllers)
SRV _kerberos._tcp.[Link] Locates Kerberos KDC
SRV _gc._tcp.[Link] Locates Global Catalog servers
NS [Link] -> dc01 Authoritative name server
SOA [Link] Start of Authority record

7.3 DNS Verification Commands

# Check SRV records are registered correctly
nslookup -type=SRV _ldap._tcp.[Link]
nslookup -type=SRV _kerberos._tcp.[Link]
nslookup -type=SRV _gc._tcp.[Link]

# Check all DC locator records

dcdiag /test:DNS /v

# Force re-registration of DNS records by Netlogon

nltest /dsregdns

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

ipconfig /registerdns
Restart-Service Netlogon

7.4 DNS Scavenging Configuration

Scavenging removes stale DNS records. Configure carefully to avoid removing active records.
# Enable scavenging on the zone
Set-DnsServerZoneAging -Name '[Link]' -Aging $true ``
-ScavengeServers @('[Link]') ``
-NoRefreshInterval 7.00:00:00 ``
-RefreshInterval 7.00:00:00

# Enable scavenging on the server

Set-DnsServerScavenging -ScavengingState $true ``
-ScavengingInterval 7.00:00:00

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

8. AD Sites & Replication

8.1 Sites Concepts
AD Sites represent physical network locations. Correct site configuration controls DC
authentication traffic and replication scheduling.
• Site: Represents a physical location (typically a subnet or building)
• Subnet: IP subnet associated with a site (e.g., [Link]/24)
• Site Link: Defines the connection and cost between sites
• Site Link Bridge: Allows transitive routing between sites (enabled by default)
• KCC: Knowledge Consistency Checker — automatically generates the replication
topology

8.2 Configuring Sites

# Create a new site
New-ADReplicationSite -Name 'London-Site'

# Create and associate subnet

New-ADReplicationSubnet -Name '[Link]/24' -Site 'London-Site'

# Create site link

New-ADReplicationSiteLink -Name 'HQ-London' ``
-SitesIncluded @('Default-First-Site-Name','London-Site') ``
-Cost 100 ``
-ReplicationFrequencyInMinutes 15

8.3 Replication Monitoring

# Check replication summary
repadmin /replsummary

# Show replication topology

repadmin /showrepl

# Show replication failures

repadmin /showrepl * /errorsonly

# Force immediate replication

repadmin /syncall /AdeP

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

# Check inbound replication queue

repadmin /queue

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

9. Active Directory Security

9.1 Tiered Administration Model
Microsoft recommends a 3-tier model to limit the blast radius of credential theft:
Tier Manages Admin Accounts Used

Tier 0 Domain Controllers, AD, PKI, ADFS Tier 0 admin accounts only
Tier 1 Servers and applications Tier 1 admin accounts only
Tier 2 Workstations and devices Tier 2 admin accounts only

9.2 Privileged Access Workstations (PAWs)

• Use dedicated hardened workstations for Tier 0 administration
• Block internet browsing and email on PAWs
• Use Just-in-Time (JIT) access for privileged accounts
• Enable Windows Credential Guard on admin workstations

9.3 Protecting High-Value Accounts

# Add account to Protected Users security group (blocks NTLM, restricts
Kerberos)
Add-ADGroupMember -Identity 'Protected Users' -Members 'Domain Admins'

# Enable fine-grained password policy for admin accounts

New-ADFineGrainedPasswordPolicy -Name 'AdminPasswordPolicy' ``
-Precedence 10 ``
-MinPasswordLength 20 ``
-PasswordHistoryCount 24 ``
-MaxPasswordAge '60.00:00:00' ``
-LockoutThreshold 3

Add-ADFineGrainedPasswordPolicySubject -Identity 'AdminPasswordPolicy' ``

-Subjects 'Domain Admins'

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

9.4 Service Account Best Practices

Account Type Best For Key Benefit

Managed Service Account Single server services Automatic password management

(MSA)
Group Managed Service Multiple server/clustered Password managed across all
Account (gMSA) services servers
Regular User Account Legacy apps only None — avoid if possible
Virtual Account Local services on single No password management needed
server

# Create gMSA
New-ADServiceAccount -Name 'svc-webapp' ``
-DNSHostName '[Link]' ``
-PrincipalsAllowedToRetrieveManagedPassword 'WebServers-Group'

# Install gMSA on a server (run on the server itself)

Install-ADServiceAccount -Identity 'svc-webapp'
Test-ADServiceAccount -Identity 'svc-webapp'

9.5 Auditing & Monitoring

# Check recent logon failures
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 50
|
Select TimeCreated, @{N='Account';E={$_.Properties[5].Value}},
@{N='Source IP';E={$_.Properties[19].Value}}

# Monitor privileged group membership changes

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4728,4732,4756} -
MaxEvents 20

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

10. Troubleshooting Guide A to Z

10.1 Authentication Issues
Problem: Users cannot log on — 'The system cannot log you on'
• Check if the account is locked out
Search-ADAccount -LockedOut | Select SamAccountName, LockedOut,
BadLogonCount
Unlock-ADAccount -Identity jsmith
• Check if the account is disabled
Get-ADUser -Identity jsmith -Properties Enabled
• Verify the DC is reachable from the client
nltest /dsgetdc:[Link] /force
• Check Kerberos time skew (must be within 5 minutes)
w32tm /query /status
w32tm /resync /force

Problem: 'Access Denied' to shared resources

• Verify the user is a member of the correct security group
Get-ADPrincipalGroupMembership jsmith | Select Name
• Run gpresult to verify correct GPOs are applied
gpresult /R /USER corp\jsmith
• Check the effective permissions on the share and NTFS
• Ensure the share is accessible (firewall ports 445 open)

Problem: Kerberos ticket errors (Event ID 4769, KDC issues)

• Verify SPNs are correctly registered
setspn -L <serviceaccount>
setspn -Q */[Link]
• Check for duplicate SPNs (a common cause of Kerberos failures)
setspn -X
• Clear Kerberos ticket cache on client
klist purge

10.2 Replication Issues

Problem: AD replication failures / Event ID 1311, 1566, 2087
• Check replication status
repadmin /replsummary

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

repadmin /showrepl * /errorsonly

• Check DNS resolution between DCs
nslookup [Link]
• Verify network connectivity between DCs
Test-NetConnection -ComputerName dc02 -Port 135
Test-NetConnection -ComputerName dc02 -Port 389
• Force replication and check for errors
repadmin /syncall /AdeP

Problem: USN Rollback (Event ID 2095)

This occurs when a DC is restored from a snapshot without proper safeguards. The DC must be
demoted and re-promoted.

WARNING: Never restore a DC snapshot in production. Use Windows Server Backup or

AD-aware backup solutions. Snapshots that bypass VSS can cause USN rollback, leading
to replication failures and data inconsistency.

10.3 DNS Issues

Problem: Clients cannot find domain controllers
• Check SRV records are present
nslookup -type=SRV _ldap._tcp.[Link]
• Force Netlogon to re-register SRV records
nltest /dsregdns
Restart-Service Netlogon
• Run DCDiag DNS test
dcdiag /test:DNS /e /v

Problem: Stale DNS records causing connectivity issues

# Find and remove stale records
Get-DnsServerResourceRecord -ZoneName '[Link]' -RRType 'A' |
Where-Object {$_.TimeStamp -lt (Get-Date).AddDays(-14)} |
Select HostName, RecordData, TimeStamp

10.4 Group Policy Issues

Problem: GPO not applying to computers or users
5. Run gpresult to see applied/filtered GPOs
gpresult /H C:\[Link] /F; Start C:\[Link]
6. Check if GPO is linked and enabled

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

Get-GPInheritance -Target
'OU=Workstations,OU=Computers,OU=_CORP,DC=corp,DC=contoso,DC=com'
7. Verify the computer/user is in the GPO's security filter
8. Check for WMI filter blocking application
9. Check SYSVOL replication is healthy
dfsrdiag replicationstate

Problem: SYSVOL not replicating (GPO changes not propagating)

# Check DFSR replication state
dfsrdiag replicationstate

# Check DFSR event log for errors

Get-WinEvent -LogName 'DFS Replication' -MaxEvents 20 | Where-Object
{$_.Level -le 3}

# Force SYSVOL resync (use carefully in production)

dfsrmig /setglobalstate 0 # Move to start
# Then follow SYSVOL migration procedure to state 3

10.5 Domain Join Issues

Problem: Computer cannot join the domain
10. Verify DNS points to a domain controller
ipconfig /all # Check DNS server IPs
nslookup [Link] # Must resolve
11. Test domain controller connectivity
Test-NetConnection -ComputerName [Link] -Port 389
12. Verify the account performing the join has permissions
• Default: any authenticated user can join up to 10 computers
• For more, delegate 'Create Computer Objects' on the target OU
13. Check for firewall blocking required ports
Port Protocol Service

53 TCP/UDP DNS
88 TCP/UDP Kerberos
135 TCP RPC Endpoint Mapper
139 TCP NetBIOS Session Service
389 TCP/UDP LDAP
445 TCP SMB (for SYSVOL/GPO)
636 TCP LDAPS (if enabled)

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

Port Protocol Service

3268 TCP Global Catalog LDAP

49152-65535 TCP Dynamic RPC ports

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

11. DCDiag Quick Reference

11.1 Essential DCDiag Commands
# Run all tests on local DC
dcdiag /v

# Run all tests on all DCs in domain

dcdiag /e /v

# Test specific components

dcdiag /test:Connectivity # Network connectivity
dcdiag /test:Replications # AD replication
dcdiag /test:KccEvent # Knowledge Consistency Checker
dcdiag /test:Services # Required services running
dcdiag /test:NetLogons # Netlogon service
dcdiag /test:DNS /v /e # DNS configuration (all DCs)
dcdiag /test:SysVolCheck # SYSVOL shared correctly

11.2 Common DCDiag Failures & Resolutions

Test Common Failure Resolution

Connectivity Cannot contact DC Check DNS, firewall, network

Replications Replication is failing Run repadmin /replsummary, check
network/DNS
KccEvent No errors (KCC running) Check Event ID 1311 in Directory
Service log
SysVolCheck SYSVOL not shared Check DFSR/FRS service, run dfsrdiag
DNS Missing SRV records Restart Netlogon, run nltest /dsregdns
Services Service not running Start-Service or restart the specific
service
NetLogons Netlogon not running Start-Service Netlogon; check
dependencies

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

12. Regular Maintenance Tasks

12.1 Weekly Health Checks
14. Check AD replication: repadmin /replsummary
15. Review failed authentication events (Event ID 4625)
16. Check for locked out accounts: Search-ADAccount -LockedOut
17. Verify DC services are running: Get-Service ADWS, KDC, Netlogon, DFSR
18. Check DNS health: dcdiag /test:DNS /e

12.2 Monthly Maintenance

19. Review and clean up stale computer accounts (inactive 90+ days)
Search-ADAccount -AccountInactive -TimeSpan 90 -ComputersOnly | Select
Name, LastLogonDate
20. Review inactive user accounts
Search-ADAccount -AccountInactive -TimeSpan 90 -UsersOnly |
Where-Object {$_.Enabled -eq $true} | Select SamAccountName,
LastLogonDate
21. Check AD database size and NTDS health
# Check NTDS database size
(Get-Item 'C:\Windows\NTDS\[Link]').Length / 1MB
22. Review Group Policy results and clean up orphaned GPOs
Get-GPO -All | Where-Object {$_.GpoStatus -eq 'AllSettingsDisabled'}
23. Verify and test backup restoration (at least quarterly)

12.3 Tombstone & Object Lifecycle

Setting Default Value Notes

Tombstone Lifetime 180 days (2008+) Objects are deleted after this period
Deleted Object Lifetime 180 days Objects in Recycle Bin (if enabled)
AD Recycle Bin Disabled by default Enable immediately for protection
Kerberos Ticket Lifetime 10 hours Configurable via Default Domain Policy
Kerberos Renewal Lifetime 7 days Max ticket renewal period

# Enable AD Recycle Bin (Forest Functional Level must be 2008 R2+)

Enable-ADOptionalFeature -Identity 'Recycle Bin Feature' ``
-Scope ForestOrConfigurationSet ``

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

-Target '[Link]'

# Restore a deleted object from Recycle Bin

Get-ADObject -Filter {displayName -eq 'John Smith'} -IncludeDeletedObjects
|
Restore-ADObject

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

13. Backup & Disaster Recovery

13.1 Backing Up Active Directory
Always use Windows Server Backup or a VSS-aware backup solution. Never use file-level copy
of [Link] while AD is running.
# Install Windows Server Backup
Install-WindowsFeature Windows-Server-Backup

# Backup System State (includes AD, SYSVOL, registry)

wbadmin start systemstatebackup -backuptarget:\\backupserver\backups -quiet

# List available backups

wbadmin get versions

13.2 Authoritative vs. Non-Authoritative Restore

Restore Type When to Use Result

Non-Authoritative DC failure; replication is intact Restored DC gets updated by replication

from other DCs
Authoritative Mass accidental deletion; need Restored objects overwrite others during
to restore specific objects replication; all DCs get restored data

Performing an Authoritative Restore

24. Boot into Directory Services Restore Mode (DSRM)
25. Restore System State backup: wbadmin start systemstaterecovery ...
26. After restore completes, before restarting, run ntdsutil
ntdsutil
activate instance ntds
authoritative restore
restore subtree "OU=Employees,DC=corp,DC=contoso,DC=com"
quit
quit
27. Restart the DC — it will replicate the restored objects to all other DCs

13.3 DSRM Password Reset

# Reset DSRM password on a running DC
ntdsutil

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

set dsrm password

reset password on server DC01
quit
quit

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

14. Quick Reference Card

14.1 Most-Used PowerShell Commands
Task Command

Find user Get-ADUser -Filter {SamAccountName -eq 'jsmith'} -Properties *

Unlock account Unlock-ADAccount -Identity jsmith
Reset password Set-ADAccountPassword jsmith -Reset -NewPassword (Read-
Host -AsSecureString)
Disable account Disable-ADAccount -Identity jsmith
Enable account Enable-ADAccount -Identity jsmith
Check locked accounts Search-ADAccount -LockedOut | Select SamAccountName
Check inactive accounts Search-ADAccount -AccountInactive -TimeSpan 90
Get DC list Get-ADDomainController -Filter *
Check FSMO roles Get-ADDomain | Select PDCEmulator, RIDMaster,
InfrastructureMaster
Check forest FSMO Get-ADForest | Select SchemaMaster, DomainNamingMaster
Move FSMO role Move-ADDirectoryServerOperationMasterRole -Identity DC02 -
OperationMasterRole PDCEmulator
Check group members Get-ADGroupMember 'Domain Admins' | Select Name
AD replication status repadmin /replsummary
Force replication repadmin /syncall /AdeP
Force GPO update gpupdate /force
Check GPO results gpresult /H C:\[Link] /F

14.2 Key Event IDs to Monitor

Event ID Log Description

4624 Security Successful logon

4625 Security Failed logon attempt
4648 Security Explicit credential logon (pass-the-hash indicator)
4720 Security User account created
4726 Security User account deleted

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

Event ID Log Description

4728/4732/4 Security Member added to privileged group

756
4740 Security Account locked out
4771 Security Kerberos pre-authentication failed
4776 Security NTLM authentication attempt
1566 Directory Service Replication warning — connection not found
2095 Directory Service USN rollback detected
1311 Directory Service Replication topology incomplete

14.3 Active Directory Ports Reference

Port Protocol Service Required For

53 TCP/UDP DNS Name resolution, DC locator

88 TCP/UDP Kerberos Authentication
135 TCP RPC Replication, management
139 TCP NetBIOS Legacy SMB
389 TCP/UDP LDAP Directory queries
445 TCP SMB SYSVOL, NETLOGON, GPO
464 TCP/UDP Kerberos Password changes
636 TCP LDAPS Secure LDAP (if configured)
3268 TCP Global Catalog Forest-wide searches
3269 TCP GC over SSL Secure GC queries
49152-65535 TCP Dynamic RPC AD replication, management

Page | Confidential & Internal Use Only

Active Directory: Complete Configuration & Troubleshooting Guide

15. Common Error Codes & Resolutions

Error Code Error Name Common Cause & Resolution

0xC000006D STATUS_LOGON_FAILU Wrong password or account doesn't exist. Verify

RE credentials.
0xC0000064 STATUS_NO_SUCH_US Account not found in the domain. Check
ER SamAccountName spelling.
0xC000006E STATUS_ACCOUNT_RE Account restriction (expired, hours, workstation).
STRICTION Check account properties.
0xC000006F STATUS_INVALID_LOG User logging on outside allowed hours. Adjust logon
ON_HOURS hours policy.
0xC0000071 STATUS_PASSWORD_ Password has expired. Reset via ADUC or
EXPIRED PowerShell.
0xC0000072 STATUS_ACCOUNT_DI Account is disabled. Enable in ADUC or with
SABLED Enable-ADAccount.
0xC0000234 STATUS_ACCOUNT_LO Account is locked out. Use Unlock-ADAccount.
CKED_OUT
0x80090325 KDC_ERR_ETYPE_NOS Kerberos encryption type mismatch. Check
UPP AES/RC4 settings.
0x80090342 SEC_E_KDC_CERT_EX KDC certificate expired (LDAPS/SmartCard). Renew
PIRED certificate.
8341 DNS No DNS servers available. Check DNS service and
configuration.
8453 Replication Access Replication account lacks permissions. Run
Denied repadmin /replsummary.
8606 Insufficient Attributes Missing required attribute for object. Check schema
requirements.

PRO TIP: For additional troubleshooting, always check the Directory Service, DNS Server,
and Security event logs on your domain controllers. Most issues leave clear evidence in
these logs with specific error codes and descriptions.

End of Active Directory Configuration & Troubleshooting Guide

Page | Confidential & Internal Use Only