Active Directory — Essential Controls

Confirms domain membership before authentication troubleshooting.

Shows the located DC and capability flags.

Checks the AD site mapped to the client subnet.

Requires the ActiveDirectory RSAT module.

Avoid -Properties * when only a few properties are needed.

Useful to confirm active lockouts.

Checks resolved group memberships.

Checks state, reported OS and recent activity.

First check for replication errors and latency.

Shows partners, naming contexts and last replication.

A persistent queue can indicate connectivity or load issues.

Very verbose and potentially slow; run deliberately.

Shows all five FSMO role holders.

PowerShell view of domain-level roles.

PowerShell view of forest roles and global catalogs.

For domain time issues, start with the PDC Emulator.

Confirms DC service records are published.

Lists Kerberos tickets in the current session.

Kerberos depends on coherent time.

Spots unexpected sources such as Local CMOS Clock.

Shows applied and filtered GPOs by context.

Easier for analyzing settings and filtering reasons.

Does not fix processing errors; inspect logs if failure persists.

Shows processing extensions and detailed errors.

On a member computer, validates trust with the domain.

Native alternative without the AD PowerShell module.

Use only after DNS, time and DC connectivity checks.

Quickly measures time offset against a DC.

Correlate time, SPN and affected account.

Useful for DC discovery and secure-channel issues.

Run on a domain controller.

Capture state before replication or trust repairs.