AD HEALTH CHECK
A read-only Active Directory recovery health check — verify a domain after a rebuild, recovery, or before you sign off
- Signed Windows executable — no installer
- Unique license key
- Instant email delivery
- Free updates
- Runs on DC or RSAT workstation
▼ AFTER YOU BUY
After a DC rebuild, a recovery, or before handing a domain back to a client, you need to know it's actually healthy — not just "seems fine." AD Health Check surveys the whole environment read-only and produces a clean PASS / WARN / FAIL report covering replication, AD backup age, the RID pool, sites & subnets, DNS, SYSVOL and DFSR backlog, Group Policy, FSMO, services, time and real clock skew, DHCP, and a full pass of Microsoft’s own dcdiag on every DC. It changes nothing — so it's safe to run in production, on any DC, at any time.
READ-ONLY BY DESIGN
Runs only queries and diagnostics — it never writes to Active Directory, DNS, or any server. That includes a deliberate exclusion: dcdiag’s DnsDynamicUpdate subtest writes a temporary record into your live DNS zone and frequently cannot remove it again, so this tool does not run it — unlike dcdiag /c on its own.
FULL-DOMAIN SURVEY
Forest / domain modes, AD Recycle Bin, DC inventory + reachability, FSMO holders, the RID pool, AD services per DC, sites & subnets, SYSVOL / NETLOGON + DFSR backlog, Group Policy consistency, and DNS (A / SRV records + orphaned-record detection) — the whole picture in one pass.
RECOVERY DIAGNOSTICS
Replication across all five naming contexts graded against the tombstone lifetime, AD backup age per DC, real clock skew (the Kerberos backbone), and Microsoft’s own dcdiag on every DC — the checks that earn the word recovery.
CLIENT-READY REPORT
A color-coded PASS / WARN / FAIL / INFO grid, plus a polished self-contained HTML report (or TXT / CSV) you can hand a client as proof the domain is healthy.
REQUIREMENTS
- Run as a domain account with AD rights (Domain Admin or delegated), elevated
- On a live DC everything is present; on a workstation, add the RSAT AD DS tools (the AD module +
repadmin+dcdiag) - Windows Server, or Windows 10 (1809+) / 11 with RSAT
- Read-only — makes no changes; elevation + domain rights give the fullest data
SUPPORTED WINDOWS
- Fully tested: Windows Server 2016, 2019, 2022, 2025
- Untested and unsupported: Server 2012 / 2012 R2 — end-of-life, never validated with this product. It may run if .NET 4.8 and WMF 5.1 are added by hand; that is not a support claim
- Workstation: Windows 10 (1809+) / 11 with RSAT
READ-ONLY
- Makes no changes to Active Directory, DNS, or any server — only reads and reports
dcdiag’s DnsDynamicUpdate subtest is not read-only — it writes a temporary record into a live zone and frequently cannot remove it again. This tool never runs it; the other DNS subtests all run- Findings are advisory; you decide what to act on
- Ideal as a pre-change baseline, a post-recovery sign-off, or a client-facing audit
- You are responsible for maintaining a current, tested FULL SYSTEM BACKUP of every domain controller in your environment. This software reads and reports — it does not create, verify, or substitute for one. The AD Backup Age check reports the age of a backup Active Directory recorded, not that it is complete or restorable
- Every session is logged automatically to
%ProgramData%\KWTechSolutions\ADHealthCheck\logs, written line by line as it happens so the record survives closing the tool or a crash. It stays on that machine; nothing is transmitted anywhere - Support covers this program only — not Active Directory, DNS, DHCP, your domain controllers, or acting on its findings
- EULA shown on launch, with a tick-box you must check before Accept works
Published by KW Tech Solutions LLC · digitally signed · EULA shown on launch