Active Directory — Essential Controls

Active Directory operations reference covering identity, replication, FSMO, DNS, Kerberos, GPO, time, secure channel and health checks.

Domain & DC context

Computer domain — Get-CimInstance Win32_ComputerSystem | Select-Object Name,Domain,PartOfDomainConfirms domain membership before authentication troubleshooting.
Locate a DC — nltest /dsgetdc:exemple.localShows the located DC and capability flags.
AD site — nltest /dsgetsiteChecks the AD site mapped to the client subnet.
Known DCs — Get-ADDomainController -Filter * | Select-Object HostName,Site,IPv4Address,IsGlobalCatalogRequires the ActiveDirectory RSAT module.

User — Get-ADUser j.dupont -Properties Enabled,LockedOut,PasswordLastSet,LastLogonDateAvoid -Properties * when only a few properties are needed.
Locked accounts — Search-ADAccount -LockedOut -UsersOnlyUseful to confirm active lockouts.
User groups — Get-ADPrincipalGroupMembership j.dupont | Select-Object NameChecks resolved group memberships.
Computer — Get-ADComputer PC-001 -Properties Enabled,LastLogonDate,OperatingSystemChecks state, reported OS and recent activity.

Summary — repadmin /replsummaryFirst check for replication errors and latency.
DC details — repadmin /showrepl DC01Shows partners, naming contexts and last replication.
Replication queue — repadmin /queue DC01A persistent queue can indicate connectivity or load issues.
Global diagnostics — dcdiag /e /c /vVery verbose and potentially slow; run deliberately.

FSMO roles — netdom query fsmoShows all five FSMO role holders.
Domain info — Get-ADDomain | Select-Object PDCEmulator,RIDMaster,InfrastructureMasterPowerShell view of domain-level roles.
Forest info — Get-ADForest | Select-Object SchemaMaster,DomainNamingMaster,GlobalCatalogsPowerShell view of forest roles and global catalogs.
PDC Emulator — Time reference and a critical role for several domain operations. For domain time issues, start with the PDC Emulator.

LDAP SRV — Resolve-DnsName _ldap._tcp.dc._msdcs.exemple.local -Type SRVConfirms DC service records are published.
Kerberos tickets — klistLists Kerberos tickets in the current session.
Time status — w32tm /query /statusKerberos depends on coherent time.
Time source — w32tm /query /sourceSpots unexpected sources such as Local CMOS Clock.

GPO summary — gpresult /rShows applied and filtered GPOs by context.
HTML report — gpresult /h C:\Temp\gpresult.htmlEasier for analyzing settings and filtering reasons.
Refresh — gpupdate /forceDoes not fix processing errors; inspect logs if failure persists.
GPO operational log — Get-WinEvent -LogName Microsoft-Windows-GroupPolicy/Operational -MaxEvents 50Shows processing extensions and detailed errors.

Test secure channel — Test-ComputerSecureChannel -VerboseOn a member computer, validates trust with the domain.
Verify with nltest — nltest /sc_verify:exemple.localNative alternative without the AD PowerShell module.
Repair — Test-ComputerSecureChannel -Repair -Credential (Get-Credential)Use only after DNS, time and DC connectivity checks.
Time skew — w32tm /stripchart /computer:DC01 /samples:5 /dataonlyQuickly measures time offset against a DC.

Kerberos events — Get-WinEvent -FilterHashtable @{LogName='System';ProviderName='Microsoft-Windows-Kerberos-Key-Distribution-Center'} -MaxEvents 30 -ErrorAction SilentlyContinueCorrelate time, SPN and affected account.
Netlogon events — Get-WinEvent -FilterHashtable @{LogName='System';ProviderName='NETLOGON'} -MaxEvents 30 -ErrorAction SilentlyContinueUseful for DC discovery and secure-channel issues.
AD DS events — Get-WinEvent -LogName 'Directory Service' -MaxEvents 50Run on a domain controller.
Before change — Capturer repadmin + dcdiag + heure + DNSCapture state before replication or trust repairs.

DNS and time synchronization are primary Active Directory prerequisites.
Avoid Domain Admin for daily work; use delegated administrative accounts.
Do not reset secure channels before excluding DNS, NTP and DC connectivity.
Interpret repadmin/dcdiag in the context of site topology and replication schedules.