SolutionBase: Troubleshooting Active Directory performance problems

This is what it looks like when you run DCDIAG

This gallery is also available as a TechRepublic article.

Every article that I can ever remember reading (or writing for that matter) in relation to troubleshooting the Active Directory has had to do with troubleshooting functionality. Those articles assume that Active Directory is either working, or it isn't. While information on troubleshooting Active Directory related functionality issues certainly has its place, I have noticed an absence of material related to troubleshooting Active Directory performance problems.

It's important for the Active Directory to not only function, but also to perform efficiently. Virtually every aspect of Windows Networking involves the use of the Active Directory in some way. If the Active Directory is having trouble keeping pace with the demands that the network is placing on it, then there can be some very noticeable consequences. For example, users might experience extremely slow logins. Likewise, users may have trouble displaying the Exchange Global Address List. In this article series, I will show you some techniques that you can use to determine the nature of your Active Directory's performance problem and what you can do to correct it.

Initial diagnostic testing

Even if everything appears to be working correctly, I recommend taking some time to verify that your Active Directory is indeed completely functional before you start studying Performance Monitor counters. There are several ways that you can accomplish this, but I recommend that you start out by running DCDIAG on each of your domain controllers.As the name implies, DCDIAG is a domain controller diagnostic utility that is included with Windows Server 2003. To use DCDIAG, simply open a Command Prompt window and enter DCDIAG at the Command Prompt. DCDIAG will then run a series of tests to make sure that the domain controller is functional. Keep in mind, that DCDIAG isn't going to do anything to check to see whether or not the domain controller is running efficiently, it is just going to run some quick diagnostics to make sure that the domain controller has at least a minimal level of functionality.

Running DCDIAG is a really quick process. The entire series of tests only take a few seconds. The testing results look something like what you see above. If DCDIAG does produce any errors though, then you should fix the cause of those errors before you attempt to track down any inefficiencies.