Checking Active Directory health before making any change: dcdiag, repadmin, and the FSMO holders

Goal

Establish that a Windows Server 2019/2022/2025 domain is structurally healthy — replication working, role holders reachable, time source sane — before an agent makes a change that assumes a working directory (joining a computer, editing a GPO, creating an OU).

Prerequisites

Domain Admins or delegated read rights; run from a domain controller or a management host with RSAT's Active Directory module and the dcdiag/repadmin/netdom binaries available.

Steps

1. Run the local diagnostics suite: dcdiag /v /c /f:dcdiag.log. /c runs the comprehensive test set, /f writes a log so the output survives a scrollback truncation in an unattended run; /test:<Test> narrows to one test (for example /test:Replications).
2. Get a fleet-wide replication overview in one call: repadmin /replsummary, which reports per-domain-controller inbound/outbound failure counts without walking each partner individually.
3. Drill into one domain controller's partners when the summary shows a problem: repadmin /showrepl DC1 /errorsonly prints only the failing connections instead of the full partner list.
4. Inventory the domain controllers before targeting one: Get-ADDomainController -Filter * | Select-Object HostName, Site, OperationMasterRoles.
5. Confirm who holds each FSMO role two ways, since a stale replica can lie about the current holder: netdom query fsmo (works even without the ActiveDirectory PowerShell module) and Get-ADForest | Select-Object SchemaMaster, DomainNamingMaster for the forest-wide roles plus Get-ADDomain | Select-Object PDCEmulator, RIDMaster, InfrastructureMaster for the domain-wide roles.
6. Check the time hierarchy: every domain controller should synchronize transitively from the PDC emulator of the forest root domain, which in turn should point at an external, authoritative source — verify with w32tm /query /source on the PDC emulator itself.

Expected result

dcdiag reports "passed test" for each test run; repadmin /replsummary shows 0 in the failure columns; the FSMO holders from netdom query fsmo and the PowerShell cmdlets agree.

Limits and test basis

repadmin /replsummary and /showrepl are documented in Microsoft's Repadmin command references; a fresh domain controller can show transient replication latency immediately after promotion, so re-run once before treating a single failed cycle as an incident. netdom query fsmo and Get-ADForest/Get-ADDomain read the same data through different interfaces (the PowerShell cmdlets go through Active Directory Web Services on TCP 9389, so they fail if that service is down while netdom still answers), so a mismatch or a one-sided failure is itself diagnostic. Run dcdiag from an elevated prompt; some tests report access errors otherwise. Microsoft's own guidance states that the PDC in the root of an Active Directory forest should be configured to synchronize with an external time source — not left on the default hierarchy alone. All commands here are read-only; nothing to undo, and no reboot is required.