Troubleshooting Active Directory. Presented by: Shawn Barker - Product Manager, Quest Software

Transcription

1 Troubleshooting Active Directory Presented by: Shawn Barker - Product Manager, Quest Software

2 Agenda Introduction to Quest Software Understanding common AD problems Troubleshooting strategies Troubleshooting utilities Simplifying your approach to AD troubleshooting

3 Quest Software Microsoft Infrastructure Management Quest Software (NASDAQ:QSFT) Founded 1987 About 2100 employees in over 40 offices: North America, South America, Europe, Asia, Australia Application management leader: 75% of Fortune 500 Develop, deploy, manage and maintain enterprise applications without downtime or business interruption Acquired Aelita Software March 2004 Solutions to Simplify, Automate and Secure

4 Background Active Directory is increasingly the most important infrastructure component within IT AD is the basis of network authentication AD also hosts crucial business applications such as Exchange 2003

5 Challenge When a problem with AD replication, performance or availability occurs, organizations need to be able to Diagnose Troubleshoot Resolve the issue as quickly as possible

6 Problem Resolution Lifecycle A problem occurs You are notified by user or monitor You diagnose and identify cause of problem You troubleshoot and resolve problem Problem solved, ticket closed Monitoring Diagnostics, troubleshooting & resolution

7 Diagnosing the Problem IT is alerted of an AD performance or availability problem Next step is to quickly identify where the problem is occurring Replication? Authentication? Name Resolution?

8 Troubleshooting the Problem To effectively troubleshoot a problem with AD you need: In-depth knowledge of AD Understanding of your environment Sound troubleshooting strategy The right tools for the job

9 Troubleshooting AD Must understand the systems behind most common AD processes: Authentication Replication Name resolution

10 Troubleshooting Process To effectively minimize the time to resolution of a problem you must: Quickly isolate system where the problem is occurring Determine cause of the problem Identify possible solutions or next steps (knowledge base, TechNet)

11 Common Problems Authentication failures Replication failures System policies not being applied File Replication Service

12 Authentication Allows users to log onto network and access resources Used by computers to log onto network Protocol options Kerberos NTLM

13 Replication Intrasite replication Continuous Configured separately for domain, schema and configuration partitions Occurs over IP Topology automatically generated by KCC Ideal configuration is 2-3 replication partners for each DC No more than 2-3 hops between DCs

14 Replication Intersite replication Between domain in one site to same domain in another site Configuration separate for each domain DC in each site configured as bridgehead Occurs over IP by default

15 System Policies Group Policy applied at logon time When user logs on, group membership is determined Resulting policies for all user s memberships applied

16 File Replication Service Responsible for replicating files between domain controllers SYSVOL Logon scripts Group Policy information

17 Common Causes Replication configuration (Intersite, Intrasite) FSMO roles File Replication Service configuration

18 Polling Question What tool do you most often use to troubleshoot replication, availability, and performance problems in Active Directory? Manual using native tools (Services Control Manager, Process Manager, etc) Resource Kit command line utilities (NTDSUTIL, REPLMON, DCDIAG, etc) Use data available from a monitoring or event log consolidation tool (MOM, other) I already own an Active Directory troubleshooting tool (Spotlight on Active Directory, other)

19 Resolving AD Problems Develop an efficient troubleshooting plan Know the tools available to you Understand AD and AD processes Know your network configuration

20 Troubleshooting Process AD transactions use the following subsystems: Client Network DNS Kerberos Global Catalog Domain Controller SYSVOL

21 Replication Configuration Check for poor configuration Manual configuration objects Schedule REPADMIN Force replication REPLMON Check replication topology Verify connectivity

22 Failed Authentication Symptoms User can t logon Some applications don t work correctly Problem IP Network DNS Domain Controller Global Catalog

23 System policies not being applied Group Policy replication AD replication for object SYSVOL for settings (FRS) Resulting set of policies RSoP MMC snap-in

24 FSMO Roles Required for single-master operations RID Master PDC Emulator Infrastructure Master Domain Naming Master Schema Master

25 RID Master Failure Inability to create security principles RID Master allocates relative identifiers to DCs when new security principles are created Domain wide role, one per domain

26 PDC Emulator Failure Workstations without AD client software installed unable to authenticate PDC Emulator represents an AD DC as the PDC to down-level clients Domain wide role, one per domain

27 Infrastructure Master Failure Changes to group memberships are not taking Infrastructure Master is responsible for updating references from objects in its domain to objects in other domains Updates outdated links from Global Catalog Domain wide role, one per domain

28 Domain Naming Master Failure Cannot add or remove a domain Domain Naming Master controls addition and removal of domains from the forest Forest wide role, one per forest

29 Schema Master Failure Inability to make modifications to the schema Failed replication of schema changes Schema Master controls all updates and modifications to the schema Forest wide role, one per forest

30 FSMO Failures Attribute problem to relevant FSMO role Determine what DC holds that FSMO role (ADU&C, Schema, Domains and Trusts MMC snap-ins) Ensure connectivity to role holder (PING, REPLMON) Restart DC Transfer/seize FSMO role to a functioning DC (NTDSUTIL)

31 File Replication Service (FRS) Check disk space on source and target Verify connectivity between partners using fully qualified names (PING) FRS uses FQDNs to communicate Ensure the FRS service is running Verify RPC connectivity Check NTFRS Connection replication object Log files: %systemroot%\debug

32 Develop a Troubleshooting Plan Are you going to search sequentially? Are you going to start with the most probably cause? Are you going to start in the middle and break the task into smaller pieces as you go?

33 Sequential Start with first system, test it, if it checks out, move on to next logical system Test client IP config Test network config Test DNS server..and so on

34 Most Probable Cause Use the information at hand and start by targeting the most probable system For example, other users complain they can t login, so test the network first DNS, DC, GC before troubleshooting the client configuration Experience with troubleshooting will start to identify certain types of problems with particular systems

35 Break the Problem Down Isolate the problem system by executing a test in one of the middle systems Based on the result, you will know which side the problem lies, and you can repeat (except problem space is now half the size)

36 Failed Authentication IP Network DNS DC Global Catalog

37 Failed Authentication IP Network DNS DC Global Catalog IPCONFIG NETDIAG.EXE PING TRACERT NSLOOKUP DCDIAG.EXE DCDIAG.EXE

38 Useful Troubleshooting Utilities Client IPCONFIG PING NETDIAG REGEDT32 Network TRACERT

39 Useful Troubleshooting Utilities Domain Controller DCDIAG LDP ADSIEdit NTDSUTIL DNS NSLOOKUP DNSCMD

40 Useful Troubleshooting Utilities Replication REPLMON REPADMIN Security ACLDIAG SDCHECK SIDWALKER Group Policy GPMC RSoP snap-in

41 DCDIAG Output

42 Spotlight on Active Directory Real-time diagnostic tool for troubleshooting Active Directory replication, performance and availability Accelerated identification, diagnosis and resolution of all Active Directory related problems

43 Spotlight on Active Directory Topology View

44 Spotlight on Active Directory Diagnostic Console

45 Problem Resolution Lifecycle A problem occurs You are notified by user or monitor Spotlight on Active Directory used to diagnose and resolve problem Problem solved, ticket closed Monitoring Diagnostics, troubleshooting & resolution Spotlight on Active Directory

46 Resources Quest Spotlight on Active Directory Accelerated resolution of Replication, Performance and Availability problems in AD Best-of-breed in-depth troubleshooting and diagnostics of AD-related issues Contact a Quest Representative ; sales@quest.com

47 Q&A

48 Thank you!