Active Directory Health Report

KingWerx™ AD Health Check v2.1.24 · KW Tech Solutions LLC

NOT HEALTHYPASS 52 · WARN 6 · FAIL 15 · INFO 11

Generated 2026-07-20 15:29Run from DC2.lab.localChecks 84PASS 52WARN 6FAIL 15

Status	Check	Detail
Context
INFO	Run-from host	DC2.lab.local
Forest
INFO	Forest / Domain modes	Forest=lab.local ForestMode=Windows2016Forest DomainMode=Windows2016Domain
WARN	AD Recycle Bin	NOT enabled (recommended; one-way change)
DCs
PASS	DC2.lab.local	Site=Default-First-Site-Name IPv4=192.168.1.211 GC=True OS=Windows Server 2019 Standard
FAIL	DC3.lab.local	UNREACHABLE Site=Default-First-Site-Name IPv4=192.168.1.212
PASS	DC1.lab.local	Site=Default-First-Site-Name IPv4=192.168.1.210 GC=True OS=Windows Server 2019 Standard
FSMO
INFO	Schema Master	DC2.lab.local
INFO	Domain Naming Master	DC2.lab.local
INFO	PDC Emulator	DC2.lab.local
INFO	RID Master	DC2.lab.local
INFO	Infrastructure Master	DC2.lab.local
PASS	Holder reachable: DC2.lab.local	responds
RID
PASS	RID pool	plenty of headroom - next RID=63601 ceiling=1073741823 remaining=1073678222
Services
PASS	DC2	ADWS=Running DFSR=Running DNS=Running kdc=Running Netlogon=Running NTDS=Running W32Time=Running
PASS	DC1	ADWS=Running DFSR=Running DNS=Running kdc=Running Netlogon=Running NTDS=Running W32Time=Running
Replication
FAIL	DC2 <= DC3 [Domain]	failures=1 lastFailure=2026-07-20 15:23:23 status=1722
PASS	DC2 <= DC1 [Domain]	lastOK=2026-07-20 15:24:47
FAIL	DC2 <= DC3 [Configuration]	failures=1 lastFailure=2026-07-20 15:24:05 status=1722
PASS	DC2 <= DC1 [Configuration]	lastOK=2026-07-20 15:24:05
FAIL	DC2 <= DC3 [Schema]	failures=1 lastFailure=2026-07-20 15:24:47 status=1722
PASS	DC2 <= DC1 [Schema]	lastOK=2026-07-20 15:24:47
FAIL	DC2 <= DC3 [DomainDnsZones]	failures=1 lastFailure=2026-07-20 15:23:23 status=1256
PASS	DC2 <= DC1 [DomainDnsZones]	lastOK=2026-07-20 15:24:47
FAIL	DC2 <= DC3 [ForestDnsZones]	failures=1 lastFailure=2026-07-20 15:23:23 status=1256
PASS	DC2 <= DC1 [ForestDnsZones]	lastOK=2026-07-20 15:24:47
FAIL	DC3	DC is UNREACHABLE - cannot query its replication view (see the UNREACHABLE row under Domain Controllers). Links FROM this DC are still checked from its live partners below.
FAIL	DC1 <= DC3 [Domain]	failures=1 lastFailure=2026-07-20 15:24:01 status=1722
PASS	DC1 <= DC2 [Domain]	lastOK=2026-07-20 15:26:00
PASS	DC1 <= DC2 [Configuration]	lastOK=2026-07-20 15:24:01
FAIL	DC1 <= DC3 [Configuration]	failures=1 lastFailure=2026-07-20 15:24:43 status=1722
PASS	DC1 <= DC2 [Schema]	lastOK=2026-07-20 15:24:43
FAIL	DC1 <= DC3 [Schema]	failures=1 lastFailure=2026-07-20 15:25:25 status=1722
FAIL	DC1 <= DC3 [DomainDnsZones]	failures=1 lastFailure=2026-07-20 15:24:01 status=1256
PASS	DC1 <= DC2 [DomainDnsZones]	lastOK=2026-07-20 15:25:25
FAIL	DC1 <= DC3 [ForestDnsZones]	failures=1 lastFailure=2026-07-20 15:24:01 status=1256
PASS	DC1 <= DC2 [ForestDnsZones]	lastOK=2026-07-20 15:25:25
Backup
WARN	DC2	oldest partition backup 2026-05-28 16:56 (52.9 days ago); newest 2026-05-28 16:56 - DANGEROUSLY stale (over 30 days). Take a fresh System State backup now and store it off-box.
WARN	DC1	oldest partition backup 2026-05-28 16:56 (52.9 days ago); newest 2026-05-28 16:56 - DANGEROUSLY stale (over 30 days). Take a fresh System State backup now and store it off-box.
Sites
PASS	Sites	1 site(s), each has at least one DC
INFO	Subnets	no subnets defined - harmless in a single-site domain (there is only one site); defining them just silences the "no client site" messages (event 5807)
SYSVOL
PASS	DC2	SYSVOL + NETLOGON shared
PASS	DC1	SYSVOL + NETLOGON shared
DFSR
PASS	DC2 <= DC1	SYSVOL backlog = 0 (converged)
PASS	DC1 <= DC2	SYSVOL backlog = 0 (converged)
GPO
PASS	GPO consistency	2 GPO(s): every AD object has its SYSVOL folder and the versions match
DNS
PASS	DC2 A record	192.168.1.211
PASS	DC3 A record	192.168.1.212
PASS	DC1 A record	192.168.1.210
PASS	Domain _ldap DC SRV	3 record(s)
PASS	DC SRV ghosts	no orphaned DC SRV records
WARN	NIC DNS server 192.168.1.212	configured but NOT answering (dead/stale entry?)
Time
WARN	DC2 (PDC) source	PDC source='Local CMOS Clock' - should sync an EXTERNAL NTP server
PASS	DC1 source	DC2.lab.local
PASS	DC2.lab.local clock skew	offset 0.000s vs DC2.lab.local
WARN	DC3.lab.local clock skew	w32tm could not read this DC's time: ICMP: error IP_REQ_TIMED_OUT - no response in 1000ms
PASS	DC1.lab.local clock skew	offset -0.161s vs DC2.lab.local
DHCP
INFO	DHCP module	DhcpServer module not present here - run on a DHCP server, or install RSAT DHCP tools (elevated): Add-WindowsCapability -Online -Name Rsat.DHCP.Tools~~~~0.0.1.0
DCDiag
FAIL	DC3	DC is UNREACHABLE - dcdiag skipped for this DC (see the UNREACHABLE row under Domain Controllers).
INFO	Comprehensive tests	reduced to essential dcdiag tests while a DC is unreachable (Connectivity, Advertising, Services, Replications, SysVolCheck, NetLogons, KnowsOfRoleHolders, MachineAccount, RidManager, NCSecDesc, ObjectsReplicated, VerifyReferences) - the comprehensive topology/security/DNS tests stall probing the down DC and only re-confirm the outage; the DCs and Replication checks above are authoritative.
PASS	DC2 / Connectivity	* Active Directory LDAP Services Check
PASS	DC2 / Advertising	The DC DC2 is advertising itself as a DC and having a DS.
PASS	DC2 / SysVolCheck	* The File Replication Service SYSVOL ready test
PASS	DC2 / KnowsOfRoleHolders	Role Schema Owner = CN=NTDS Settings,CN=DC2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=lab,DC=local
PASS	DC2 / MachineAccount	Checking machine account for DC DC2 on DC DC2.
PASS	DC2 / NCSecDesc	* Security Permissions check for all NC's on DC DC2.
PASS	DC2 / NetLogons	* Network Logons Privileges Check
PASS	DC2 / ObjectsReplicated	DC2 is in domain DC=lab,DC=local
FAIL	DC2 / Replications	[Replications Check,DC2] A recent replication attempt failed:
PASS	DC2 / RidManager	* Available RID Pool for the Domain is 63601 to 1073741823
PASS	DC2 / Services	* Checking Service: EventSystem
PASS	DC2 / VerifyReferences	The system object reference (serverReference)
PASS	DC1 / Connectivity	* Active Directory LDAP Services Check
PASS	DC1 / Advertising	The DC DC1 is advertising itself as a DC and having a DS.
PASS	DC1 / SysVolCheck	* The File Replication Service SYSVOL ready test
PASS	DC1 / KnowsOfRoleHolders	Role Schema Owner = CN=NTDS Settings,CN=DC2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=lab,DC=local
PASS	DC1 / MachineAccount	Checking machine account for DC DC1 on DC DC1.
PASS	DC1 / NCSecDesc	* Security Permissions check for all NC's on DC DC1.
PASS	DC1 / NetLogons	* Network Logons Privileges Check
PASS	DC1 / ObjectsReplicated	DC1 is in domain DC=lab,DC=local
FAIL	DC1 / Replications	[Replications Check,DC1] A recent replication attempt failed:
PASS	DC1 / RidManager	* Available RID Pool for the Domain is 63601 to 1073741823
PASS	DC1 / Services	* Checking Service: EventSystem
PASS	DC1 / VerifyReferences	The system object reference (serverReference)
INFO	Not run by dcdiag	need extra parameters / not general health checks: CheckSecurityError, CutoffServers, FrsEvent, DFSREvent, KccEvent, OutboundSecureChannels, SystemLog, Topology, VerifyEnterpriseReferences, VerifyReplicas, DNS, CheckSDRefDom, CrossRefValidation, LocatorCheck, Intersite

Read-only report generated by KingWerx™ AD Health Check (KW Tech Solutions LLC). No changes were made to Active Directory, DNS, or any server; findings are advisory and provided AS-IS, without warranty of any kind. Microsoft, Windows, Windows Server, and Active Directory are trademarks of Microsoft Corporation. AD Health Check is an independent product of KW Tech Solutions LLC and is not affiliated with, authorized, sponsored, or endorsed by Microsoft.