Configuring a Computer for Troubleshooting Active Directory

To configure your computer for troubleshooting, perform the following tasks:

Install Windows Server 2003 SP1 [http://technet2.microsoft.com/WindowsServer/en/library/e921e661-e2ec-45be-a1b2-903e77125e971033.mspx#BKMK_1]

Install Windows Support Tools [http://technet2.microsoft.com/WindowsServer/en/library/e921e661-e2ec-45be-a1b2-903e77125e971033.mspx#BKMK_2]

Install Network Monitor [http://technet2.microsoft.com/WindowsServer/en/library/e921e661-e2ec-45be-a1b2-903e77125e971033.mspx#BKMK_3]

Set logging levels [http://technet2.microsoft.com/WindowsServer/en/library/e921e661-e2ec-45be-a1b2-903e77125e971033.mspx#BKMK_4]

If possible, upgrade domain controllers to Windows Server 2003 Service Pack 1 (SP1). To install this service pack, go to the Microsoft Web site [http://go.microsoft.com/fwlink/?LinkId=9999] (http://go.microsoft.com/fwlink/?LinkId=9999) and follow instructions for downloading the service pack.

The advantages of running Windows Server 2003 with SP1 with regard to troubleshooting include enhancements to the Ntdsutil command-line tool. Ntdsutil.exe has new functionality that makes it easier to remove domain controller metadata and to authoritatively restore directory objects.

For improved diagnostic support, install Windows Support Tools that ship with Windows Server 2003 SP1. The SP1 version of Windows Support Tools includes enhanced versions of the Dcdiag.exe and Repadmin.exe tools. The Dcdiag.exe command-line tool now provides new reporting on the overall health of replication with respect to Active Directory security, as well as new Domain Name System (DNS) diagnostic tests. You can use Repadmin.exe to manage replication consistency settings on multiple domain controllers instead of editing the registry on individual computers.

Make sure that the SP1 version of Windows Support Tools is installed on all domain controllers that are running Windows Server 2003 with SP1.

You can run Windows Support Tools that ship with Windows Server 2003 SP1 on computers running the following operating systems:

You can also run some tools, such as Repadmin.exe and Dcdiag.exe, on computers running Windows XP Professional, Windows XP Professional with SP1, or Windows XP Professional with Service Pack 2 (SP2). Options for other tools vary by tool. In this guide, the operating system that is required for running a tool is specified as a prerequisite for each procedure.

The SP1 version of Windows Support Tools can be installed as an .msi package only on computers running Windows Server 2003 with SP1. To run Repadmin and Dcdiag from computers running Windows Server 2003 without SP1 or from computers running Windows XP Professional, you must copy the respective executable files to those computers.

Requirements

Use Network Monitor to troubleshoot connectivity issues by tracing network traffic between computers. For information about installing and using Network Monitor, see Network Monitor [http://go.microsoft.com/fwlink/?LinkId=42987] on the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=42987).

If the information that you receive in the Directory Service log in Event Viewer is not sufficient for troubleshooting, raise the logging levels by using the appropriate registry entry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics.

By default, the logging levels for all entries are set to 0, which provides the minimum amount of information. The highest logging level is 5. Increasing the level for an entry causes additional events to be logged in the Directory Service event log. The following diagram shows the diagnostic entries that are available.

Directory Service Diagnostic Logging Levels

Use the following procedure to change the logging level for a diagnostic entry.

Requirements