Windows Server Center
Guided diagnostics and copy-ready commands for Active Directory, DNS, DHCP, GPO, RDP, services, storage, VSS, certificates and Windows Update.
dcdiag /e /c /vrepadmin /replsummaryrepadmin /showreplnetdom query fsmonltest /dsgetdc:exemple.localnslookup -type=SRV _ldap._tcp.dc._msdcs.exemple.localGet-DnsServerZoneGet-DnsServerForwarderGet-DhcpServerv4ScopeGet-DhcpServerv4ScopeStatisticsGet-DhcpServerv4OptionValuegpupdate /forcegpresult /h C:\Temp\gpresult.htmlTest-NetConnection -ComputerName <SERVER> -Port 3389quserGet-Service | Where-Object {$_.StartType -eq 'Automatic' -and $_.Status -ne 'Running'}sc.exe qc <SERVICE>Get-VolumeGet-PhysicalDiskchkdsk C: /scanvssadmin list writersvssadmin list providersvssadmin list shadowstoragecertutil -pulseGet-ChildItem Cert:\LocalMachine\MyDISM /Online /Cleanup-Image /ScanHealthDISM /Online /Cleanup-Image /RestoreHealthsfc /scannowipconfig /allTest-NetConnection -ComputerName <TARGET> -Port 443route printGet-NetTCPConnectionGet-WinEvent -FilterHashtable @{LogName='System';Level=1,2} -MaxEvents 50Get-WinEvent -FilterHashtable @{LogName='System';Id=<ID>} -MaxEvents 30Event Viewer search generator
Check DNS first
In an AD domain, almost always start by checking DNS and system time.
Do not restore a DC like a regular VM
Follow Active Directory procedures and your backup software guidance.
Review nearby Event IDs
A single event is rarely enough to understand the root cause.
Test before repairing
Prefer non-destructive diagnostic commands before making changes.
Document changes
Record the GPOs, services, certificates and settings changed during the intervention.
Check the backup
Before a risky operation, make sure a usable restore point exists.
Center mission
8 playbooksQuickly isolate whether the incident comes from system resources, services, Active Directory, DNS, GPOs or time synchronization, collecting evidence before any change.
Quick triage
- Confirm start time, scope and affected users or servers.
- Check CPU, memory, volumes and free space before restarting anything.
- Check critical services and recent System/Application events.
- Validate DNS, gateway and domain name resolution.
- On a DC, check replication, SYSVOL, time and replication partners.
Decision tree
Start with CPU/RAM/disk, then identify the dominant process or I/O.
Check service, dependencies and events before a targeted restart.
Prioritize DNS, AD replication, SYSVOL and time synchronization.
Compare before/after, generate gpresult and revisit the latest change.
Intervention playbooks
Start read-only, collect evidence, then change one variable at a time.
01Slow server / high CPURead-only
Slow sessions, difficult RDP or poorly responsive applications without an obvious network error.
Checks
- Identify the dominant process and separate CPU, memory and I/O pressure.
- Compare current load with the incident start time.
- Look for correlated application or system errors.
Commands / evidence
Get-Process | Sort-Object CPU -Descending | Select-Object -First 15Get-Counter \Processor(_Total)\% Processor Time,\Memory\Available MBytesGet-WinEvent -LogName System -MaxEvents 50Expected result
Resources remain under control and no process continuously monopolizes CPU, RAM or disk.
Corrective actions
- Address the identified process or service instead of rebooting the whole server.
- If saturation is scheduled, correct the task or its execution window.
Escalate when
Saturation returns without an identifiable cause, affects a critical role or causes service loss.
02System disk nearly fullControlled change
Critical C: volume, failed updates or services unable to write.
Checks
- Measure free space and identify constrained volumes.
- Check shadow copies, logs, dumps and temporary directories.
- Check whether abnormal growth is recent.
Commands / evidence
Get-Volume | Sort-Object SizeRemainingvssadmin list shadowstorageGet-ChildItem C:\ -Force -ErrorAction SilentlyContinue | Sort-Object Length -Descending | Select-Object -First 20Expected result
A consumption cause is identified before deletion and sustainable free-space margin is restored.
Corrective actions
- Clean only items identified as safe or adjust their retention.
- Extend the volume if growth is legitimate and documented.
Escalate when
The volume contains unidentified business data, critical snapshots or the underlying storage is itself saturated.
03Critical service will not startControlled change
A role or application stays stopped after server startup or service restart.
Checks
- Read status, startup type and dependencies.
- Correlate Service Control Manager and application events.
- Check service account, rights and external dependencies.
Commands / evidence
Get-Service <Service> | Format-List *sc.exe qc <Service>Get-WinEvent -FilterHashtable @{LogName="System"; ProviderName="Service Control Manager"} -MaxEvents 30Expected result
The failing dependency or error code explains why the service does not reach Running.
Corrective actions
- Fix the dependency or account before a targeted restart.
- Keep events and exact timestamps for vendor analysis if needed.
Escalate when
The service handles a critical database, still refuses to start or corruption is suspected.
04GPO not appliedRead-only
An expected user or computer setting is missing on one or more machines.
Checks
- Confirm OU, security/WMI filtering and inheritance.
- Compare expected GPO with the actually applied list.
- Check SYSVOL access and GroupPolicy errors.
Commands / evidence
gpresult /h C:\Temp\gpresult.htmlgpupdate /forceGet-WinEvent -LogName Microsoft-Windows-GroupPolicy/Operational -MaxEvents 50Expected result
The GPO appears as applied or an explicit denial/filtering reason is visible.
Corrective actions
- Fix scope or filtering instead of repeatedly running gpupdate.
- Validate on a pilot workstation before broader rollout.
Escalate when
SYSVOL is inaccessible, multiple DCs diverge or errors affect the whole domain.
05Active Directory replication errorIntrusive / escalation
Objects differ between DCs, replication errors occur or authentication is inconsistent.
Checks
- Summarize errors by DC and partner.
- Check DNS, RPC connectivity and time between controllers.
- Check SYSVOL/DFSR health.
Commands / evidence
repadmin /replsummaryrepadmin /showrepl * /errorsonlydcdiag /e /test:replications /test:dnsExpected result
All partners replicate without recent errors and replication latency remains consistent.
Corrective actions
- Fix DNS/routing/time before any intrusive replication action.
- Document source DC, destination and exact error code before escalation.
Escalate when
USN rollback, lingering objects, suspected NTDS corruption or multiple DCs become unreliable.
06Domain DNS inconsistencyRead-only
Intermittent resolution, domain join failure or AD services not discovered.
Checks
- Check configured DNS servers and avoid public DNS on domain members.
- Test domain SRV records.
- Compare short/FQDN and reverse responses where needed.
Commands / evidence
Get-DnsClientServerAddressResolve-DnsName _ldap._tcp.dc._msdcs.<domaine> -Type SRVnltest /dsgetdc:<domaine>Expected result
Clients use AD DNS and SRV records return reachable DCs.
Corrective actions
- Fix client/DHCP DNS settings before changing zones.
- Remove only truly stale records after verification.
Escalate when
AD-integrated zones diverge, DNS replication errors occur or several critical SRV records disappear.
07Broken secure channelControlled change
Trust relationship error between workstation/server and domain or failed machine authentication.
Checks
- Test the secure channel without repairing it immediately.
- Validate DNS, time and DC availability.
- Check that the computer object exists and was not restored inconsistently.
Commands / evidence
Test-ComputerSecureChannel -Verbosenltest /sc_verify:<domaine>w32tm /query /statusExpected result
Secure channel is True and the machine locates a consistent DC.
Corrective actions
- Repair with authorized credentials only after DNS/time validation.
- Avoid leaving/rejoining the domain as a first action.
Escalate when
The issue affects multiple machines, an old snapshot was restored or the DC itself is suspect.
08Kerberos / time synchronizationRead-only
Kerberos failures, repeated credential prompts or access denied without permission changes.
Checks
- Measure time drift and identify the NTP source.
- Check Kerberos tickets and the DC in use.
- On the PDC Emulator, confirm the authoritative time source.
Commands / evidence
w32tm /query /statusw32tm /query /sourceklistExpected result
Clocks remain synchronized and tickets are issued by the domain without excessive drift.
Corrective actions
- Fix the NTP hierarchy before purging or renewing tickets.
- After correction, retest with a fresh authentication.
Escalate when
The domain NTP source is unstable, multiple sites drift or KDCs report persistent errors.
End-of-intervention checklist
- Confirm the original symptom is no longer reproducible.
- Review critical events after the fix.
- Test from at least one representative client.
- Document command, result and change performed.
- Schedule monitoring if the cause may recur.