Chat now with support
Chat mit Support

Active Administrator 8.6.3 - Web Console User Guide

Active Administrator Web Console Overview Active Directory Health Alerts Notifications Active Directory Health Check
Using the Health Check landing page Creating a Health Check Setting options for Health Check tests Purging Health Check History Health check tests
Forest tests Domain tests Domain controller tests Site tests
Active Directory Topology Reports Network Operations Center

Domain controller time synchronization

Indicates that the time of the target domain controller differs from one of its reference sources by more than the configured threshold (in seconds).

Category
•
General
Requirements
•
Supported on: Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019
•
Required permissions: When monitored locally and remotely, only domain user privilege is required. When monitored remotely, the target server must have WMI remote access enabled and the user must be a member of the Distributed COM Users group.
Description

The Windows® Time (W32Time) service on a domain controller is responsible for maintaining the accuracy of the clock with respect to the time sources. Active Directory® defines rules for time sources as follows:

•
A domain controller in a domain will synchronize its clock to the domain controller in the domain that is the PDC Role Owner for its domain, unless the domain controller in question is the PDC Role Owner.
•
If the domain controller is the PDC Role Owner, it will synchronize its clock with the PDC Role Owner of its parent domain, unless the domain controller is in the root domain.
•
If the domain controller is in the root domain and it is the PDC Role Owner for that domain, it must be configured to synchronize its clock to an external time source.

A special case exists for the PDC Role Owner in domains that are at the root of the forest but are not the root domain (the root domain being defined as the first domain ever created in the forest). These domain controllers synchronize themselves to the PDC Role Owner in the root domain.

Any domain controller can have these settings overridden by configuring the domain controller to synchronize with an external time source using the Net Time command. If the domain controllers are so configured, then the DirectoryAnalyzer agent will check the time against the configured external time source(s).

Resolution
•
Ensure that the W32Time service is running on the domain controller that has this alert.
•
Check the event log on the domain controller to determine ensure that the W32Time service is not reporting errors.
•
Since the domain controller must have connectivity to its time source in order to synchronize its clock, use Active Directory Health Analyzer to determine if other connectivity related alerts may be occurring.

File replication (NTFRS) staging space free in kilobytes

Indicates that the amount of disk space allocated for staging files during replication is less than or equal to the specified threshold.

Category:
•
Performance Counters
Requirements
•
Supported on: Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019
•
Required permissions: When monitored locally and remotely, only domain user privilege is required and the user must be a part of the Performance Logs user group.
Description

Tests the FileReplicaSet\KB of Staging Space Free performance counter on the domain controller to see if the value of the performance counter drops below the configured threshold for a period exceeding the configured duration.

If the File Replication Service (FRS) runs out of staging disk space, replication will stop. The size of the contents of the staging areas for all active replication sets are subtracted from the user controlled size.

A low disk space condition can be due to many different things. Some possibilities are:

•
The size of the data to be replicated is larger than the staging area
•
There are too many replica sets active at once
•
There are files destined for one or more out-bound partners that have not been connected for a while
Resolution

One possible solution is to increase the amount of space allowed for file staging.

1
Determine that the number and size of the files that need replicating will fit in the amount of space allocated. The staging areas can be found by searching the registry.
The HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\ReplicaSet registry key contains one or more sub-keys using a GUID as the key name for each active replica set. Each replica set contains both a Replica Set Root and Replica Set Stage value.
•
The Replica Set Root value describes the file system folder that will be replicated.
•
The Replica Set Stage value describes the folder that is used for the staging area. The staging areas can be inspected to determine which one(s) are consuming disk space.
2
Check the amount of space allocated by viewing the Staging Space Limit in KB value under the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs registry key. This value defines the maximum amount of disk space that can be consumed by all staging areas at any one time.
3
If you determine that the staging areas need more disk space, increase the value of the Staging Space Limit in KB.

If the problem cannot be resolved by adjusting the amount of space needed and allowed, turn your attention towards replication schedules and the connectivity between computers. The SYSVOL share is replicated between all domain controllers in the same domain. Other replication partners can be found using the Distributed File System (DFS) console.

1
Check that the server has good connectivity with each of its replication partners. Ping the replication partners from the domain controller that issued this alert to determine if there is connectivity. The problem may be that DNS has the incorrect address or that the IP stack for the domain controller or the Active Directory Health Analyzer agent is misconfigured.
2
Use the Active Directory® Sites and Services snap-in to confirm that replication schedules allow replication partners to communicate.

GC replication latency

Indicates that the replication latency of the server that hosts a replica of the global catalog equals or exceeds the configured threshold.

* 
NOTE: The replication latency tests create or modify objects in Active Directory®, and then check for those changes on each selected domain controller. The length of time for the tests to complete is dependent on the number of domains and domain controllers you select.
Category
•
Replication Latency
Requirements
•
Supported on: Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019
•
Required permissions: Domain user privileges with rights to list contents, create objects, read and write properties under the AATemp organizational unit in the domain root.
Description

The elapsed time between changing a distinct object on each domain controller and the time the change appears in every copy of the global catalog. This test applies to all domain controllers that host a replica of the Global Catalog.

Resolution
•
Check connectivity between both the domain controller and the replication partner in question.
•
Check to see that the link is reasonably clear, especially during replication.
•
Check the replication schedule for the connection.
•
Make sure that each partner has adequate CPU and memory resources to ensure timely servicing of replication requests.
•
Make sure that the link between partners is adequate for the amount of traffic carried during replication.

Group policy object inconsistent

Indicates the Group Policy object (GPO) for a given policy has fallen out of sync with the representation stored on the local SYSVOL share.

Category
•
General
Requirements
•
Supported on: Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019
•
Permission requirements: When monitored locally and remotely, only domain user privilege is required.
Description

This situation typically arises from high replication latency or duplicated NTDS Connection Objects.

Resolution

A Group Policy Object on <server-name> is represented inconsistently between the local directory and the local file system. This problem can be remedied by forcing NTFRS and Active Directory® to refresh.

Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen