Active Directory Health Check automation via Powershell

It’s important to run some Active Directory Health checks on your domain. To that end, I thought it would be great to generate a weekly report that contained a DCdiag, a Repadmin and Best Practice Analyzer report. This could be done via a Scheduled task. It could then run once a week and then email you with any issues. A great way to keep on top of the health of your environment and to make sure no little niggling errors are hiding just under the covers, waiting to destroy your environment.

The hardest part of the script was executing the cmd prompt command via the script. Passing in arguments is messy in Powershell at the best of times, but passing in arguments with spaces and having to escape the correct characters etc is very tedious. So, as a disclaimer, this script is a work in progress. It works, but by no means is it an example of Powershell Best Practice. (I’ll keep a tinkering on it, and if anyone has any suggestions please leave a comment.) Hopefully, though, someone other then me may find this useful.

There are also a few caveats to be aware of. This script, the way it is presented here, will only work on Powershell v3. I found this out because in an effort to get the BPA cmdlets working, I realized that the syntax for the commands are different in the different versions of Powershell. If you would like to get this to work on Powershell v2, you just need to change the -ModelID parameters to -ID. A quick “Get-Help Invoke-BPAModel” should sort that out pretty swiftly. Also, the file locations are hard coded at this point.

You can find some more information about DCDiag command here.
You can find some more information about the Repadmin command here.
Here is some information aswell about running the BPA via Powershell

Tagged , , , , , . Bookmark the permalink.

13 Responses to Active Directory Health Check automation via Powershell

  1. Pingback: Active Directory Health Check Discovery Steps | Chase’s Notes

  2. Bradley says:

    will this check every DC in the domain or do I need to install this on each DC in the domain?

    You call this with a schedule task, do you use the system account to run the scheduled task or a domain user with rights?

    • wolffhaven says:

      It checks all dc’s. I run it under a domain user. You might want to lock down the user account so it only has the rights it needs to run scheduled tasks but not to log on etc. Or, I think you could probably used a Group Managed Service account?

  3. Bradley says:

    will this check every DC in the domain or do I need to install this on each DC in the domain?

    You call this with a schedule task, do you use the system account to run the scheduled task or a domain user with rights?

    • wolffhaven says:

      It checks all dc’s. I run it under a domain user. You might want to lock down the user account so it only has the rights it needs to run scheduled tasks but not to log on etc. Or, I think you could probably used a Group Managed Service account?

  4. Hey, great script. I will add this to an article im working on, on how to perform and AD health check – http://www.networkangel.net/active-directory-health-check-tools

  5. Hey, great script. I will add this to an article im working on, on how to perform and AD health check – http://www.networkangel.net/active-directory-health-check-tools

  6. Nick says:

    Active Directory Health Profiler is a tool that in my view is one of the very best in Active Directory Health management. I think we should give this one a try?
    http://adhealthprof.itdynamicpacks.net/

    Best,
    Nick

  7. Nick says:

    Active Directory Health Profiler is a tool that in my view is one of the very best in Active Directory Health management. I think we should give this one a try?
    http://adhealthprof.itdynamicpacks.net/

    Best,
    Nick

  8. Justme says:

    Nick,

    I could not find any pricing on it anywhere. Must be darned expensive, and with Powershell being essentially free . . .

  9. Justme says:

    Nick,

    I could not find any pricing on it anywhere. Must be darned expensive, and with Powershell being essentially free . . .

  10. Salone says:

    I don’t know about the pricing as well, but I’m using the free version that helps me do what I need!

    –Salone

  11. Salone says:

    I don’t know about the pricing as well, but I’m using the free version that helps me do what I need!

    –Salone

Leave a Reply

Your email address will not be published. Required fields are marked *