sysop@hub:~/tools/dcdiag-reader$

dcdiag-reader

dcdiag and repadmin tell you everything about the health of Active Directory, in a wall of dots and error numbers. Paste the output here. You get which domain controller fails what, what each failed test and each replication error really means, which failures are only a consequence of another one, and what to do first. The text is read by your browser and never uploaded.

Drop the text file here, or click to choose itThe output of dcdiag, repadmin /replsummary and repadmin /showrepl, in one file or several pasted together

getting the output

Run these on a domain controller in an elevated prompt, as a domain admin. They only read. The file ends up in the folder you are in.

dcdiag /e /c /v > adhealth.txt
repadmin /replsummary >> adhealth.txt
repadmin /showrepl * /errorsonly >> adhealth.txt

/e tests every domain controller of the forest, /c runs the full set of tests, /v adds the detail that explains a failure.
In a large forest, leave out /e and name one server with /s:DC01.
repadmin /showrepl * /csv is read as well.
Output from a German Windows Server is understood too.

what it reads

From	What
dcdiag	Every "passed test" and "failed test" line per server, with the lines dcdiag printed before a failure. 24 tests are explained, among them Connectivity, Advertising, Replications, SysVolCheck, DFSREvent, Services, KnowsOfRoleHolders, RidManager, NetLogons, DNS and SystemLog.
repadmin /showrepl	Every failed replication link with partner, partition, error number and the count of failures in a row.
repadmin /replsummary	The largest time since a successful replication per server, and the error if one is shown.
Error numbers	1722, 1753, 1256, 5, 8453, 8524, 8606, 8614, 8456, 8457, 1908, 1396, 1727, 1311, 58 and "the target principal name is incorrect".

The page reads text. It cannot see the event logs the tests point at, and a test that passes says only that this test passed at that moment. Commands in the steps that change something (resetting a machine account password, seizing a role, removing lingering objects, demoting a controller) are named so that you know what to read up on, not as a script to run: take a backup of a healthy domain controller first, and for anything you have not done before, read Microsoft's article for that error number. Related: Active Directory cheat sheet, DNS and DHCP cheat sheet, Group Policy cheat sheet, Entra Connect cheat sheet.