Chat now with support
Chat with Support

Active Administrator 8.6 - Web Console User Guide

Active Administrator Web Console Overview Active Directory Health Alerts Notifications Active Directory Health Check
Using the Health Check landing page Creating a Health Check Setting options for Health Check tests Purging Health Check History Health check tests
Forest tests Domain tests Domain controller tests Site tests
Active Directory Topology Reports Network Operations Center

RID master not responding

Indicates that the relative identifier (RID) operations master is not responding within the configured threshold.

Requirement
•
Supported on: Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019
•
Required permissions: Domain user privilege is required.
Description

This error can occur if any of the following occurs:

•
The indicated server is not actually a domain controller.
•
The domain controller no longer has connectivity to the network.
•
The DNS records for the domain controller are incorrect; e.g., the IP address for the domain controller is not what is published in DNS.
•
Active Directory® on the domain controller has failed in some way.
•
Active Directory on the domain controller is overloaded and is taking too long to respond.
•
The domain controller is not running.
Resolution
•
Ping the domain controller from the Active Directory Health Analyzer agent to see if there is connectivity. If there is not, fix that problem. The problem may be that DNS has the incorrect address or that the IP stack for the domain controller or the Analyzer agent is misconfigured.
•
Make sure the domain controller is running. If the domain controller is not running, start it.
•
Make sure the indicated domain controller actually exists. If it does not exist, run NTDSUTIL and select the metadata cleanup option to clean up the erroneous objects in the directory.
•
Check the LDAP response time for the domain controller. If it is too high, you may need to add another domain controller for the same domain in the same site.

RID operations master inconsistent

Indicates that the relative identifier (RID) operations master is not consistent among all domain controllers in the domain.

Requirement
•
Supported on: Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019
•
Required permissions: Domain user privilege is required.
Description

The domain RID operations master is contained in the fSMORoleOwner property of the RID Manager object in the CN=System,DC=<domain> container. Every domain controller in the domain has a copy of the domain RID operations master. The RID operations master allocates sequences of RIDs to each of the various domain controllers in its domain. At any time, there can be only one domain controller acting as the RID master in each domain in the forest.

Whenever a domain controller creates a user, group, or computer object, the domain controller assigns the object a unique security ID (SID). The SID consists of a domain SID, which is the same for all SIDs created in the domain, and a RID, which is unique for each SID created in the domain. If the domain RID operations master is inconsistent, it is possible that two different domain controllers will assign overlapping RID ranges to other domain controllers in the domain, with potentially disastrous consequences.

The domain RID operations master can become inconsistent due to replication errors or if an administrator used NTDSUTIL.EXE to move the operations master when there was incomplete connectivity to all domain controllers in the domain.

Resolution

Wait to see if the error clears. If an administrator has moved an operations master to another domain controller, replication to all domain controllers in the domain can take some time.

If the error does not clear, contact your Microsoft® Windows® support representative.

Root PDC time source missing

Indicates the PDC Role Owner of the root domain in the forest is not configured to use an external time source. All domain controllers in the forest synchronize their time by the clock of the PDC Role Owner.

Requirement
•
Supported on: Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019
•
Required permissions: Domain user privilege is required and the target server must have WMI remote access enabled. The user must be a member of the Distributed COM Users group.
Description

Since Active Directory®, by default, sets all the clocks on all of the domain controllers in the forest from the PDC Role Owner of the root domain, it is recommended that the domain controller be configured to synchronize its time with an external time source.

Resolution

Use the w32time command at an elevated PowerShell® session to configure the PDC Role Owner to use an external time source.

w32tm /config /manualpeerlist:TimeSource /syncfromflags:MANUAL

Where TimeSource is one or more NTP servers noted by DNS or IP address. When TimeSource is a list of time servers the list must be enclosed in double quotes and each entry must be separated by at least one space. Some examples are listed below:

w32tm /config /manualpeerlist:pool.ntp.org /syncfromflags:MANUAL
w32tm /config /manualpeerlist:”1.pool.ntp.org 2.pool.ntp.org“ /syncfromflags:MANUAL

Domain controller tests

Domain controller tests are divided into four categories that are organized on four tabs. You can select tests from all four tabs to run together.

General tests

Active Administrator contains the following domain controller general tests:

•
Consecutive replication failures threshold exceeded
•
DFSRS conflict area disk space
•
DFSRS conflict files generated
•
DFSRS RDC is not enabled
•
DFSRS sharing violation
•
DFSRS staged file age
•
DFSRS staging area disk space
•
Domain controller relative identifier (RID)
•
Domain controller responsive
•
Domain controller time synchronization
•
Group policy object inconsistent
•
Installed applications
•
Installed updates
•
Invalid primary DNS domain controller IP address
•
Invalid secondary DNS domain controller IP address
•
LDAP response time
•
Logic disk details
•
Memory details
•
Missing domain controller SRV DNS record
•
NetLogon folder shared
•
Network adapter information
•
Operating system details
•
Primary DNS resolver not responding
•
Secondary DNS resolver not responding
•
SysVol details
•
SysVol folder shared
Performance counters

Active Administrator contains the following domain controller performance counters tests:

•
Cache copy read hits
•
CPU processor time
•
DFSRS % processor time
•
DFSRS private bytes
•
DFSRS USN records accepted
•
DFSRS working set
•
File replication (NTFRS) staging space free in kilobytes
•
LSASS % processor time
•
LSASS private bytes
•
LSASS working set
•
Memory page faults a second
•
NTDS DRA inbound properties filtered a second
•
NTDS LDAP searches a second
•
NTDS LDAP writes a second
•
Server sessions
Windows services

Active Administrator contains the following domain controller Windows services tests:

•
Active Directory Domain Service
•
DFS namespace service
•
DFS replication service
•
Kerberos Key Distribution Center service
•
NetLogon Windows service
•
Windows Time service
Replication latency

Active Administrator contains the following domain controller replication latency tests:

•
DC replication latency
•
GC replication latency
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating