Active Administrator 8.6.2 - Web Console User Guide

Required permissions: When monitored locally and remotely, only domain user privilege is required and the user must be a part of the Performance Logs user group.

Description

Tests the Processor\% Processor Time performance counter on the domain controller to see if the value of the performance counter goes above the configured threshold for a period exceeding the configured duration.

Increased CPU load is a result of running too many applications on the server, or running applications that require too much CPU time.

It is also possible that the CPU load has increased due to some pathological condition in a particular application. For instance, Active Directory® itself requires substantial CPU resources when it is processing inherited Access Control Lists (ACLs). Active Directory can also require a lot of CPU resources when it processes complex, non-indexed directory searches.

Resolution

First, try to determine if the increased CPU load is due to a particular program, or if it is due to running too many programs. Use a utility like Task Manager to inspect the CPU usage of all processes on the system. If there are several processes getting more than 10% of the CPU, then the problem is most likely due to running too many programs on the server. If possible, stop some of the programs.

If one process is using all of the CPU for an extended period of time, it may be due to a bug in the software, or it may be that the program just requires too much CPU. If possible, stop the program and run it on a different machine.

DC replication latency

Indicates that replication changes from one domain controller to all other domain controllers in the naming context exceeds the configured threshold.


	NOTE: The replication latency tests create or modify objects in Active Directory, and then check for those changes on each selected domain controller. The length of time for the tests to complete is dependent on the number of domains and domain controllers you select.

Category

•

Replication Latency

Requirements

•

Supported on: Windows Server 2016, Windows Server 2019, and Windows Server 2022

•

Required permissions: Domain user privileges with rights to list contents, create objects, read and write properties under the AATemp organizational unit in the domain root.

Description

This test checks latency between each domain controller in the domain by creating an object on a domain controller and then checking every other domain controller for the change. Once the change is noticed, the time difference is recorded.


	NOTE: On service startup there is a 5 minute delay before Active Administrator Data Service (ADS) starts checking replication, and then every hour after that. If the latency container does not exist, it is created and there is a 10 minute delay. The latency containers are located at AATemp\Latency under the domain. There is a timeout for the test. The timeout is the alert value plus three minutes. If the alert is set to 20 minutes and the test is still running at 23 minutes it will end.

High replication latency values mean that changes you make in the directory are taking too long to replicate to all of the other domain controllers, which can cause operational difficulties. For example, a user cannot use a new password if the password has not replicated to their domain controller. High replication latency values can also cause directory problems. If you make a change to the Configuration naming context by adding a new site or a new domain controller, the replication process will not work correctly until all domain controllers have a copy of the new site or new domain controller.

High latency times are usually due to poor network connectivity, non-functional domain controllers, or incorrect replication schedules.


	NOTE: This test only measures replication latency to another domain controller if replication actually occurs on that domain controller. If the domain controller is down or disconnected, this test will not measure the latency to that domain controller.

Resolution

Make sure that the replication latency is actually too high. In a site with fewer than five domain controllers, the intra-site replication latency should be around five minutes. As you add domain controllers in a site, the intra-site replication latency should go up to about 20-30 minutes, and then stabilize. Inter-site replication latency depends entirely on the link schedules between the sites.

If the latency truly is too high, make sure there are no domain controllers that are down. If a single domain controller acts as a bridgehead between sites, and it goes down, replication will never actually occur.

DFS namespace service

Indicates the Distributed File System (DFS) namespace service is stopped.

Category

•

Windows Services

Requirements

•

Supported on: Windows Server 2016, Windows Server 2019, and Windows Server 2022

•

Required permissions: When monitored locally, only domain user privilege is required. When monitored remotely, domain administrator privilege is required.

Description

This test checks if the DFS Namespace service is running.

Resolution

Use the Services MCC snap-in or another SCP application to restart the DFS Namespace service.

DFS replication service

Indicates that a server hosting Distributed File System (DFS) is running, but the DFS Replication (DFSR) service is not. A DFSR service not running can affect group policies.

Category

•

Windows Services

Requirements

•

Supported on: Windows Server 2016, Windows Server 2019, and Windows Server 2022

•

Required permissions: When monitored locally, only domain user privilege is required. When monitored remotely, domain administer privilege is required.

Description

This test queries the Service Control Manager (SCM) to determine if the DFS Replication service is up and running.

DFS Namespaces and DFS Replication offer simplified but highly-available access to files, load sharing, and WAN-friendly replication.

The most typical cause of this alert is when a server administrator shuts down the DFS service and forgets to restart it.

Resolution

•

Check the status of the service by running the Services MMC snap-in. Select the Server DNS (not DNS Client) entry. If the status is stopped, then the service is actually down.

•

If the DFS service is stopped, use the Services MCC snap-in or another SCP application to restart the DFS Service. Check the Event Logs and fix any problems indicated by the logs.