We help IT Professionals succeed at work.

Domain Controller repair Tools

quickslvr used Ask the Experts™
our DC`s need a checkup and some fixes because the replication and GPOs are not working properly.

is there a tool i can run thru to make fixes and helps me with repair?
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
There are no Hot fixes which will automatically run and fix the probelm.

Basically you need to identify what are the things which are causing the problem.

From your post it seems that Sysvol folder is not replication properly.

Refer below link which will discuss what need to be done if sysvol share is missing.


I would request you to run dcdiag /q and repadmin /replsum on the domain controller and post the results here if above does not help.


You can try Ntdutil and Dcdiag tools.which is available in windows itself or download from microsoft site.


Ntdsutil.exe to perform database maintenance of Active Directory, manage and control single master operations, create application directory partitions, and remove metadata

The Dcdiag command-line tool

This command-line tool analyzes the state of domain controllers in a forest or enterprise and reports any problems to assist in troubleshooting. As an end-user reporting program, Dcdiag encapsulates detailed knowledge of how to identify abnormal behavior in the system. Dcdiag displays command output at the command line.

Dcdiag consists of a framework for executing tests and a series of tests to verify different functional areas of the system. This framework selects which domain controllers are tested according to scope directives from the user, such as enterprise, site, or single server.


could you post some useful commands?
You can start with the following commands:

1. Repadmin /showrepl

The repadmin /showrepl command helps you understand the replication topology and replication failures. It reports status for each source domain controller from which the destination has an inbound connection object. The status report is categorized by directory partition.

2. Repadmin /syncall /A

Repadmin /syncall command synchronizes a specified domain controller with all of its replication partners.

switch /A Synchronizes all naming contexts that are held on the home server.

And if there are any orphan entries or lingering objects, use the command;

repadmin /removelingeringobjects <targetDCFQDN> <sourceDCguid> <partitionLDAPdn> /ADVISORY_MODE

For clear and detailed information, refer the URL below:


Hope it helps


ok,thx. i will try them.

the reason why im asking is: we have client GPO`s which are not catching up. i thought maybe this would help with that issue
Here are some more command lines,

DC Diag

This report will identify issues with domain controllers and any services associated with them:

C:\>dcdiag.exe /v >> c:\pre_dcdiag.txt
DNS Diag

This test will assess the health of DNS services, records and entries for the entire Enterprise.

C:\>dcdiag.exe /Dnsall >> c:\pre_dnsdiag.txt

Net Diag

Net Diag will identify problems with network components and configuration. Note that this tool has been depreciated in Windows 2008 but can still be used in compatibility mode.
C:\>netdiag.exe /v >> c:\pre_netdiag.txt

Netsh DHCP

This command, ran within netsh, will show the status of the local DHCP server.
C:\>netsh dhcp show server >> c:\pre_dhcp.txt


This command will show the status of inter-domain replication and wether or not it is successful. Be aware that DC's holding the global catalog role will return additional information:
C:\>repadmin /showreps >> c:\pre_rep_partners.txt

A more exhaustive report can be ran using:

C:\>repadmin /replsum /errorsonly >> c:\pre_repadmin_err.txt


Once you have ran your reports, analyze them then re-run the checks and pipe the output to post_ rather than pre_, for example:

C:\>dcdiag.exe /v >> c:\post_dcdiag.txt





i have to verify the GPo status since some of them are not working properly.

do you have any commands for this?

If you are running on Windows Server 2003, you can use Gpotool.exe to determine if there is an inconsistency between Active Directory and SYSVOL versions.

You can also refer the URL below to check and resolve the issue:

Kini pradeepDevelopment Manager

inconsistencies in applying GPO's usually happen when sysvol replication is broken.
first check AD replication as suggested above, in addition also check the domain controller FRS / DFS eventviewer for errors.
Top Expert 2012

Dcdiag would be the best to start with