Fotolia
Monitor Active Directory replication via PowerShell
Most enterprises rely on Active Directory to control access to resources on the network. Here's how admins can use PowerShell to check the health of the replication process.
Most enterprises depend on Active Directory for their authentication and identity needs. If the replication process breaks down, administrators need to know quickly to prevent issues with the services and applications that Active Directory oversees.
It is important to monitor Active Directory replication to ensure the process remains healthy. Larger organizations that use Active Directory typically have several domain controllers that rely on replication to synchronize networked objects -- users, security groups, contacts and other information -- in the Active Directory database. Changes in the database can be made at any domain controller, which must then be duplicated to the other domain controllers in an Active Directory forest. If the changes are not synchronized to a particular domain controller -- or all domain controllers -- in an Active Directory site, users in that location might encounter problems.
For example, if an administrator applies a security policy setting via a Group Policy Object to all workstations, all domain controllers in a domain should pick up the GPO changes. If one domain controller in a particular location fails to receive this update, users in that area will not receive the security configuration.
Why does Active Directory replication break?
Active Directory replication can fail for several reasons. If network ports between the domain controllers are not open or if the connection object is missing from a domain controller, then the synchronization process generally stops working.
Since domain controllers rely on the domain name system, if their service records are missing, the domain controllers will not communicate with each other, which causes a replication failure.
Check Active Directory replication status manually
There are many ways to check the Active Directory replication status manually.
Administrators can run the following string using the command-line repadmin utility to show the replication errors in the Active Directory forest:
repadmin /replsum /bysrc /bydest /errorsonly
Administrators can also use the Get-ADReplicationPartnerMetadata PowerShell cmdlet to check the replication status, which is used in the script further in this article.
Use a script to check replication health
While larger organizations might have an enterprise tool, such as System Center Operations Manager, to monitor Active Directory, a PowerShell script can be a helpful supplement to alert administrators on the replication status. Because so much of a business relies on a properly functioning Active Directory system, it can't hurt to implement this script and have it run every day via a scheduled task. If the script finds an error, it will send an alert via email.
The system must meet a few requirements before executing the script:
- It runs on a computer that reaches all domain controllers.
- It is recommended to use a computer that runs Windows Server 2012 R2 or a Windows 10 computer joined to a domain in the Active Directory forest.
- The computer has the Active Directory PowerShell modules installed.
How does the script work?
The PowerShell script uses the Get-ADReplicationPartnerMetadata cmdlet, which connects to a primary domain controller emulator in the Active Directory forest and then collects the replication metadata for each domain controller.
The script checks the value of the LastReplicationResult attribute for each domain controller entry. If the value of LastReplicationResult is zero for any domain controller, the script considers this a replication failure. If this error is found, the script executes the Send-MailMessage cmdlet to send the email with a copy of the report file in a CSV file. The script stores the replication report in C:\Temp\ReplStatus.CSV.
The settings in the script should be modified to use the email address to send the message along with the subject line and message body.
PowerShell script to check replication status
The following PowerShell script helps admins monitor Active Directory for these replication errors and delivers the findings via email. Be sure to modify the email settings in the script.
$ResultFile = "C:\Temp\ReplStatus.CSV"
$ADForestName = "TechTarget.com"
$GetPDCNow =Get-ADForest $ADForestName | Select-Object -ExpandProperty RootDomain | Get-ADDomain | Select-Object -Property PDCEmulator
$GetPDCNowServer = $GetPDCNow.PDCEmulator
$FinalStatus="Ok"
Get-ADReplicationPartnerMetadata -Target * -Partition * -EnumerationServer $GetPDCNowServer -Filter {(LastReplicationResult -ne "0")} | Select-Object LastReplicationAttempt, LastReplicationResult, LastReplicationSuccess, Partition, Partner, Server | Export-CSV "$ResultFile" -NoType -Append -ErrorAction SilentlyContinue
$TotNow = GC $ResultFile
$TotCountNow = $TotNow.Count
IF ($TotCountNow -ge 2)
{
$AnyOneOk = "Yes"
$RCSV = Import-CSV $TestCSVFile
ForEach ($AllItems in $RCSV)
{
IF ($AllItems.LastReplicationResult -eq "0")
{
$FinalStatus="Ok"
$TestStatus="Passed"
$SumVal=""
$TestText="Active Directory replication is working."
}
else
{
$AnyGap = "Yes"
$SumVal = ""
$TestStatus = "Critical"
$TestText="Replication errors occurred. Active Directory domain controllers are causing replication errors."
$FinalStatus="NOTOK"
break
}
}
}
$TestText
IF ($FinalStatus -eq "NOTOK")
{
## Since some replication errors were reported, start email procedure here...
### START - Modify Email parameters here
$message = @"
Active Directory Replication Status
Active Directory Forest: $ADForestName
Thank you,
PowerShell Script
"@
$SMTPPasswordNow = "PasswordHere"
$ThisUserName = "UserName"
$MyClearTextPassword = $SMTPPasswordNow
$SecurePassword = Convertto-SecureString –String $MyClearTextPassword –AsPlainText –force
$ToEmailNow ="EmailAddressHere"
$EmailSubject = "SubjectHere"
$SMTPUseSSLOrNot = "Yes"
$SMTPServerNow = "SMTPServerName"
$SMTPSenderNow = "SMTPSenderName"
$SMTPPortNow = "SMTPPortHere"
### END - Modify Email parameters here
$AttachmentFile = $ResultFile
$creds = new-object -typename System.Management.Automation.PSCredential -argumentlist "$ThisUserName", $SecurePassword
Send-MailMessage -Credential $Creds -smtpServer $SMTPServerNow -from $SMTPSenderNow -Port $SMTPPortNow -to $ToEmailNow -subject $EmailSubject -attachment $AttachmentFile -UseSsl -body $message
}
When the script completes, it generates a file that details the replication errors.
Administrators can run this script automatically through the Task Scheduler. Since the script takes about 10 minutes to run, it might be best to set it to run at a time when it will have the least impact, such as midnight.
