Summary
The Windows Directory Services troubleshooter collects information to help troubleshoot common issues that are related to Directory Services technologies.
More Information
When you run the troubleshooter, you may receive the following prompt.
The Do Not Collect Detailed DFSR Information option prevents the collection of DFSR Debug log files, DFSR health reports, and database GUIDs. Select this option to reduce the amount of data that is collected if your troubleshooting does not involve the DFSR service.
The Collect Detailed DFSR Information option gathers all the DFSR-related diagnostic data that is listed in the tables in the "Information collected" section. Select this option when you troubleshoot the DFSR service.
Audit policy
DCDiag
DFSR Debug Log Files
DFSR Health Reports
DFSR Miscellaneous
DNS Client
Domain Controller Promotion Logs
Dr. Watson log files
Environment Variables
Event Log Files
File Version Information (ChkSym)
FSMO Role Owners
Functional Levels and Group Membership Information
Group Policy Service Log
Installed updates/hotfixes
Kerberos tickets and TGT
Memory dump related information
Netlogon Log
NetSetup Log
Networking Information
Process and Thread Status (pstat)
Registry Entries
Replication Diagnostics Tool
Resultant Set of Policy (RSoP)
Schedule Tasks Information
Server Manager Information
System Information (MSInfo32)
System Security Settings
TCP Port Usage
Upper and lower filters information
User and Group Information
User Environment Debug Log
User Rights Assignments
Virtualization Information
Windows Firewall Configuration
W32Time
Winlogon Log
WINS Client
The Do Not Collect Detailed DFSR Information option prevents the collection of DFSR Debug log files, DFSR health reports, and database GUIDs. Select this option to reduce the amount of data that is collected if your troubleshooting does not involve the DFSR service.
The Collect Detailed DFSR Information option gathers all the DFSR-related diagnostic data that is listed in the tables in the "Information collected" section. Select this option when you troubleshoot the DFSR service.
Information collected
Applied Security Templates| Description | File Name |
| Applied Security Templates | {Computername}_AppliedSecTempl.txt |
Audit policy
| Description | File Name |
| Auditpol Audit Policy Auditpol Get Configuration output Auditpol Current Per User policy Auditpol Per User configured accounts | {Computername}_Auditpolicy.csv {Computername}_Auditpol_Configuration.txt {Computername}_Auditpol_UserPolicy.txt {Computername}_Auditpol_Per-User.txt |
DCDiag
| Description | File Name |
| DCDiag Verbose DCDiag DNS DCDiag Topology | {Computername}_DCDiag-Verbose.log {Computername}_DCDiag-DNS.log {Computername}_DCDiag-Topology.log |
DFSR Debug Log Files
| Description | File Name |
| DFSR Current Log File DFSR Previous Log file | Dfsr*.log Dfsr*.log.gz |
DFSR Health Reports
| Description | File Name |
| Health Report (.html) Health Report (.xml) | {Computername}_DFSR_{RG_Name}_HealthReport.html {Computername}_DFSR_{RG_Name}_HealthReport.xml |
DFSR Miscellaneous
| Description | File Name |
| DFSR Data Collection Script Progress File DFSR Conflicts and Deletes DFSR File Versions DFSR Configuration Information DFSR Performance Data DFSR Database GUIDs DFSR Machine Config XML File DFSR Registry Key TCPIP Registry Key DFSR Replica XML File DFSR Volume XML File DFS Management Trace Log (Current) DFS Management Trace Log (Previous) | DFSR__Progress.txt {Computername}_DFSR_ConflictAndDeleted.xls {Computername}_DFSR_File_Versions.txt {Computername}_DFSR_Info.txt {Computername}_DFSR_Performance_Data.txt {Computername}_DFSR_DBGUIDs.txt {Computername}_DFSR_DfsrMachineConfig.XML {Computername}_DFSR_RegKey_DFSR.txt {Computername}_DFSR_RegKey_TCPIP.txt {Computername}_DFSR_Replica_{GUID}.XML {Computername}_DFSR_Volume_{GUID}.XML {Computername}_DFSR_DfsMgmt.current.log {Computername}_DFSR_DfsMgmt.previous.log |
DNS Client
| Description | File Name |
| DNS Client - HOSTS file Ipconfig /displaydns DNS Client netsh show state (for DirectAccess)DNS Client registry output | {COMPUTERNAME}_DnsClient_HostsFile.TXT {COMPUTERNAME}_DnsClient_ipconfig-displaydns.TXT {COMPUTERNAME}_DnsClient_netsh_dnsclient-show-state.TXT {COMPUTERNAME}_DnsClient_reg_.TXT |
Domain Controller Promotion Logs
| Description | File Name |
| Domain Controller promotion debug log from \Windows\debug Domain Controller promotion UI debug log from \Windows\debug | {Computername}_DCPromo.log {Computername}_DCPromoUI.log |
Dr. Watson log files
| Description | File Name |
| Drwatson log file from \Windows Drwtsn32 log file from \All Users | {Computername}_Drwatson.log {Computername}_Drwtsn32.log |
Environment Variables
| Description | File Name |
| Environment Variables | {Computername}_EnvironmentVariables.txt |
Event Log Files
| Description | File Name |
| System (.csv) System (.evtx) System (.txt) Application (.csv) Application (.evtx) Application (.txt) Security (.csv) Security (.evtx) Security (.txt) DFS Replication (.csv) DFS Replication (.evtx) DFS Replication (.txt) DNS Server (.csv) DNS Server (.evtx) DNS Server (.txt) Active Directory Web Services (.csv) Active Directory Web Services (.evtx) Active Directory Web Services (.txt) Microsoft-Windows-Application-Experience/Program-Inventory (.csv) Microsoft-Windows-Application-Experience/Program-Inventory (.evtx) Microsoft-Windows-Application-Experience/Program-Inventory (.txt) Microsoft-Windows-CAPI2/Operational (.csv) Microsoft-Windows-CAPI2/Operational (.evtx) Microsoft-Windows-CAPI2/Operational (.txt) Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational (.csv) Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational (.evtx) Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational (.txt) Microsoft-Windows-DNS-Client/Operational (.csv) Microsoft-Windows-DNS-Client/Operational (.evtx) Microsoft-Windows-DNS-Client/Operational (.txt) Microsoft-Windows-EnrollmentPolicyWebService/Admin (.csv) Microsoft-Windows-EnrollmentPolicyWebService/Admin (.evtx) Microsoft-Windows-EnrollmentPolicyWebService/Admin (.txt) Microsoft-Windows-EnrollmentWebService/Admin (.csv) Microsoft-Windows-EnrollmentWebService/Admin (.evtx) Microsoft-Windows-EnrollmentWebService/Admin (.txt) Microsoft-Windows-Folder Redirection/Operational (.csv) Microsoft-Windows-Folder Redirection/Operational (.evtx) Microsoft-Windows-Folder Redirection/Operational (.txt) Microsoft-Windows-GroupPolicy/Operational (.csv) Microsoft-Windows-GroupPolicy/Operational (.evtx) Microsoft-Windows-GroupPolicy/Operational (.txt) Microsoft-Windows-NetworkProfile/Operational (.csv) Microsoft-Windows-NetworkProfile/Operational (.evtx) Microsoft-Windows-NetworkProfile/Operational (.txt) Microsoft-Windows-NlaSvc/Operational (.csv) Microsoft-Windows-NlaSvc/Operational (.evtx) Microsoft-Windows-NlaSvc/Operational (.txt) Microsoft-Windows-NTLM/Operational (.csv) Microsoft-Windows-NTLM/Operational (.evtx) Microsoft-Windows-NTLM/Operational (.txt) Microsoft-Windows-TerminalServices-Licensing/Admin (.csv) Microsoft-Windows-TerminalServices-Licensing/Admin (.evtx) Microsoft-Windows-TerminalServices-Licensing/Admin (.txt) Microsoft-Windows-TerminalServices-Licensing/Operational (.csv) Microsoft-Windows-TerminalServices-Licensing/Operational (.evtx) Microsoft-Windows-TerminalServices-Licensing/Operational (.txt) Microsoft-Windows-User Profile Service/Operational (.csv) Microsoft-Windows-User Profile Service/Operational (.evtx) Microsoft-Windows-User Profile Service/Operational (.txt) Microsoft-Windows-Windows Firewall With Advanced Security/Firewall (.csv) Microsoft-Windows-Windows Firewall With Advanced Security/Firewall (.evtx) Microsoft-Windows-Windows Firewall With Advanced Security/Firewall (.txt) Microsoft-Windows-Winlogon/Operational (.csv) Microsoft-Windows-Winlogon/Operational (.evtx) Microsoft-Windows-Winlogon/Operational (.txt) | {Computername}_evt_System.csv {Computername}_evt_System.evtx {Computername}_evt_System.txt {Computername}_evt_Application.csv {Computername}_evt_Application.evtx {Computername}_evt_Application.txt {Computername}_evt_Security.csv {Computername}_evt_Security.evtx {Computername}_evt_Security.txt {Computername}_evt_DFSReplication.csv {Computername}_evt_DFSReplication.evtx {Computername}_evt_DFSReplication.txt {Computername}_evt_DNSServer.csv {Computername}_evt_DNSServer.evtx {Computername}_evt_DNSServer.txt {Computername}_evt_ActiveDirectoryWebServices.csv {Computername}_evt_ActiveDirectoryWebServices.evtx {Computername}_evt_ActiveDirectoryWebServices.txt {Computername}_evt_ApplicationExperienceProgram-Inventory.csv {Computername}_evt_ApplicationExperienceProgram-Inventory.evtx {Computername}_evt_ApplicationExperienceProgram-Inventory.txt {Computername}_evt_CAPI2-Operational.csv {Computername}_evt_CAPI2-Operational.evtx {Computername}_evt_CAPI2-Operational.txt {Computername}_evt_ CertificateServicesClient-CredentialRoaming-Operational.csv {Computername}_evt_ CertificateServicesClient-CredentialRoaming-Operational.evtx {Computername}_evt_ CertificateServicesClient-CredentialRoaming-Operational.txt {Computername}_evt_DNS-Client-Operational.csv {Computername}_evt_DNS-Client-Operational.evtx {Computername}_evt_DNS-Client-Operational.txt {Computername}_evt_EnrollmentPolicyWebService-Admin.csv {Computername}_evt_ EnrollmentPolicyWebService-Admin.evtx {Computername}_evt_ EnrollmentPolicyWebService-Admin.txt {Computername}_evt_EnrollmentWebService-Admin.csv {Computername}_evt_ EnrollmentWebService-Admin.evtx {Computername}_evt_ EnrollmentWebService-Admin.txt {Computername}_evt_Folder Redirection-Operational.csv {Computername}_evt_Folder Redirection-Operational.evtx {Computername}_evt_Folder Redirection-Operational.txt {Computername}_evt_GroupPolicy-Operational.csv {Computername}_evt_GroupPolicy-Operational.evtx {Computername}_evt_GroupPolicy-Operational.txt {Computername}_evt_NetworkProfile-Operational.csv {Computername}_evt_NetworkProfile-Operational.evtx {Computername}_evt_NetworkProfile-Operational.txt {Computername}_evt_NlaSvc-Operational.csv {Computername}_evt_NlaSvc-Operational.evtx {Computername}_evt_NlaSvc-Operational.txt {Computername}_evt_NTLM-Operational.csv {Computername}_evt_NTLM-Operational.evtx {Computername}_evt_NTLM-Operational.txt {Computername}_evt_TerminalServices-Licensing-Admin.csv {Computername}_evt_TerminalServices-Licensing-Admin.evtx {Computername}_evt_TerminalServices-Licensing-Admin.txt {Computername}_evt_TerminalServices-Licensing- Operational.csv {Computername}_evt_TerminalServices-Licensing- Operational.evtx {Computername}_evt_TerminalServices-Licensing- Operational.txt {Computername}_evt_UserProfileService-Operational.csv {Computername}_evt_UserProfileService-Operational.evtx {Computername}_evt_UserProfileService-Operational.txt {Computername}_evt_WindowsFirewallWithAdvancedSecurity-Firewall.csv {Computername}_evt_WindowsFirewallWithAdvancedSecurity-Firewall.evtx {Computername}_evt_WindowsFirewallWithAdvancedSecurity-Firewall.txt {Computername}_evt_Winlogon-Operational.csv {Computername}_evt_Winlogon-Operational.evtx {Computername}_evt_Winlogon-Operational.txt |
File Version Information (ChkSym)
| Description | File Name |
| C:\Program Files\*.sys C:\Program Files\*.sys C:\Program Files (x86)\*.sys C:\Program Files (x86)\*.sys C:\Windows\System32\drivers\*.* C:\Windows\System32\drivers\*.* C:\Windows\System32\*.DLL C:\Windows\System32\*.DLL C:\Windows\SysWOW64\*.dll C:\Windows\SysWOW64\*.dll C:\Windows\System32\*.EXE C:\Windows\System32\*.EXE C:\Windows\SysWOW64\*.exe C:\Windows\SysWOW64\*.exe C:\Windows\System32\*.SYS C:\Windows\System32\*.SYS C:\Windows\SysWOW64\*.sys C:\Windows\SysWOW64\*.sys C:\Windows\System32\Spool\*.* C:\Windows\System32\Spool\*.* C:\Windows\System32\iscsi*.* C:\Windows\System32\iscsi*.* Running Processes Running Processes Running Drivers Running Drivers | {Computername}_sym_ProgramFiles_SYS.CSV {Computername}_sym_ProgramFiles_SYS.TXT {Computername}_sym_ProgramFilesx86_SYS.CSV {Computername}_sym_ProgramFilesx86_SYS.TXT {Computername}_sym_Drivers.CSV {Computername}_sym_Drivers.TXT {Computername}_sym_System32_DLL.CSV {Computername}_sym_System32_DLL.TXT {Computername}_sym_SysWOW64_DLL.CSV {Computername}_sym_SysWOW64_DLL.TXT {Computername}_sym_System32_EXE.CSV {Computername}_sym_System32_EXE.TXT {Computername}_sym_SysWOW64_EXE.CSV {Computername}_sym_SysWOW64_EXE.TXT {Computername}_sym_System32_SYS.CSV {Computername}_sym_System32_SYS.TXT {Computername}_sym_SysWOW64_SYS.CSV {Computername}_sym_SysWOW64_SYS.TXT {Computername}_sym_PrintSpool.CSV {Computername}_sym_PrintSpool.TXT {Computername}_sym_MS_iSCSI.CSV {Computername}_sym_MS_iSCSI.TXT {Computername}_sym_Process.CSV {Computername}_sym_Process.txt {Computername}_sym_RunningDrivers.CSV {Computername}_sym_RunningDrivers.TXT |
FSMO Role Owners
| Description | File Name |
| FSMO role owner information via netdom | {Computername}_NetdomFSMO.txt |
Functional Levels and Group Membership Information
| Description | File Name |
| Functional Levels and Group Membership Information | {Computername}_DSMisc.txt |
Group Policy Service Log
| Description | File Name |
| Group Policy Service Debug Log (gpsvc.log) from \windows\debug\usermode | {Computername}_gpsvc.txt |
Installed updates/hotfixes
| Description | File Name |
| Update/Hotfix history Update/Hotfix history Update/Hotfix history | {Computername}_Hotfixes.CSV {Computername}_Hotfixes.htm {Computername}_Hotfixes.TXT |
Kerberos tickets and TGT
| Description | File Name |
| KList | {Computername}_KList.txt |
Memory dump related information
| Description | File Name |
| Memory dump report Memory dump report Memory dump file (minidumps) | {Computername}_DumpReport.htm {Computername}_DumpReport.txt {Computername}_DMP_{Date}.zip |
Netlogon Log
| Description | File Name |
| Netlogon Log file | {Computername}_NetLogon.Log |
NetSetup Log
| Description | File Name |
| NetSetup Log file | {Computername}_netsetup.log |
Networking Information
| Description | File Name |
| TCP/IP Basic Information SMB Basic Information | {Computername}_TcpIp-Info.txt {Computername}_SMB-Info.txt |
Process and Thread Status (pstat)
| Description | File Name |
| Information about process and threads using pstat.exe | {Computername}_Pstat.txt |
Registry Entries
| Description | File Name |
| Registry Entries Output | {Computername}_REGENTRIES.txt |
Replication Diagnostics Tool
| Description | File Name |
| Replication topology overview via ‘repadmin.exe /showrepl’ output | {Computername}_Repadmin-Showrepl.txt |
Resultant Set of Policy (RSoP)
| Description | File Name |
| GPResult /H output (.txt) GPResult /H output (.htm) | {Computername}_GPResult.txt {Computername}_GPResult.htm |
Schedule Tasks Information
| Description | File Name |
| Schedule Tasks List Schedule Tasks List | {Computername}_schtasks.csv {Computername}_schtasks.txt |
Server Manager Information
| Description | File Name |
| Server Manager Log File Roles and features (servermanagercmd) (.txt) Roles and features (servermanagercmd) (.xml) | {Computername}_ServerManager.log {Computername}_ServerManagerCmdQuery.txt {Computername}_ServerManagerCmdQuery.xml |
System Information (MSInfo32)
| Description | File Name |
| System Information (MSInfo32) (.txt) System Information (MSInfo32) (.nfo) | {Computername}_msinfo32.txt {Computername}_msinfo32.nfo |
System Security Settings
| Description | File Name |
| System Security Settings file | {Computername}_Security-settings.inf |
TCP Port Usage
| Description | File Name |
| TCP Port usage output | {Computername}_PortUsage.txt |
Upper and lower filters information
| Description | File Name |
| Fltrfind Output | {Computername}_FltrFind.txt |
User and Group Information
| Description | File Name |
| Whoami /all Output | {Computername}_Whoami.txt |
User Environment Debug Log
| Description | File Name |
| User environment debug log (UserEnv.*) from \windows\debug\usermode | {Computername}_userenv.* |
User Rights Assignments
| Description | File Name |
| UserRights Output | {Computername}_userrights.txt |
Virtualization Information
| Description | File Name |
| Virtualization Information Output (.htm) Virtualization Information Output (.txt) | {Computername}_Virtualization.htm {Computername}_Virtualization.txt |
Windows Firewall Configuration
| Description | File Name |
| Windows Firewall Configuration | {Computername}_FirewallConfig.txt |
W32Time
| Description | File Name |
| W32Time Reg Key W32Time Reg Key Perms W32Time Service Status W32Time Service Perms W32TM /Monitor W32TM /TestIf /QPS W32TM /TZ W32TM Query Status W32TM Stripchart | {Computername}_W32Time_Reg_Key.txt {Computername}_W32Time_Reg_Key_Perms.txt {Computername}_W32Time_Service_Status.txt {Computername}_W32Time_Service_Perms.txt {Computername}_W32TM_Monitor.txt {Computername}_W32TM_TestIf_QPS.txt {Computername}_W32TM_TZ.txt {Computername}_W32TM_Query_Status.txt {Computername}_W32TM_Stripchart.txt |
Winlogon Log
| Description | File Name |
| Winlogon Log file | {Computername}_winlogon.log |
WINS Client
| Description | File Name |
| WINS Client nbtstat output WINS Client registry output WINS Client - LMHOSTS file | {Computername}_WinsClient_nbtstat-output.TXT {Computername}_WinsClient_reg_output.TXT {Computername}_WinsClient_LmhostsFile.TXT |
Additional Information
In addition to the files collected and listed in this article, this diagnostic can take one or more of the following actions:- Check whether Active Directory replication is failing for one or more partitions: Status 1256 - The remote system is not available
- Check whether Active Directory replication is failing for one or more partitions: Status 1722 - The RPC server is unavailable
- Check whether Active Directory replication is failing for one or more partitions: Status 8452 - The naming context is in the process of being removed
- Check for Symantec Endpoint Protection MR1/MR2
- Check for unsupported versions of Windows Vista or Windows Server 2008
- Check whether driver verifier has been enabled for at least one driver
- Check whether EMC Replistor Software is on machine but KB 975759 is not installed
- Check whether one or more Advanced Format Disks (512e) are detected on the systemCheck if page heap is enabled against one or more processes
- Check whether there are any 4K native drives on the system
- Detect whether operating system installed is evaluation media
- Check for high CPU usage by Local Security Authority Subsystem Service (LSASS)
- Check whether Lingering objects have been detected
- Check for one or more Active Directory replication failures has been detected
- Check whether SYSVOL and/or NETLOGON shares are missing on domain controller
- Check whether Active Directory replication is failing for one or more partitions: Status 8453 - Replication Access Was Denied
References
For more information about the diagnostic tool, click the following article number to go to the article in the Microsoft Knowledge Base:
973559 Frequently asked questions about the Microsoft Support Diagnostic Tool (MSDT) when it is used with Windows 7 or Windows Server 2008 R2