Le maintien de l’int\u00e9grit\u00e9 de votre environnement\u00a0Active Directory (AD)<\/a>\u00a0est crucial pour la stabilit\u00e9 et la s\u00e9curit\u00e9 des syst\u00e8mes informatiques. Un AD malsain peut entra\u00eener des \u00e9checs d’authentification, des probl\u00e8mes de r\u00e9plication et des perturbations plus importantes sur le r\u00e9seau d’une entreprise. Ce script\u00a0PowerShell<\/a>\u00a0est con\u00e7u pour rationaliser le processus d’\u00e9valuation et de d\u00e9pannage des\u00a0contr\u00f4les d’int\u00e9grit\u00e9 d’Active Directory<\/strong>, offrant une m\u00e9thode structur\u00e9e et automatis\u00e9e pour les professionnels de l’informatique et les\u00a0fournisseurs de services g\u00e9r\u00e9s (MSP).<\/a><\/p>\n Active Directory est la cl\u00e9 de vo\u00fbte de nombreux environnements informatiques d’entreprise, g\u00e9rant l’authentification des utilisateurs, les strat\u00e9gies de groupe et les services d’annuaire. Toutefois, garantir son bon fonctionnement peut s’av\u00e9rer complexe, compte tenu du nombre de points de d\u00e9faillance potentiels. Ce script utilise l’utilitaire de ligne de commande DCDiag pour analyser l’\u00e9tat d’un contr\u00f4leur de domaine, identifier les probl\u00e8mes potentiels et rapporter les r\u00e9sultats. Pour les MSP et les administrateurs informatiques, cet outil est inestimable, car il fournit un aper\u00e7u clair de l’int\u00e9grit\u00e9 d’AD et facilite une maintenance proactive.<\/p>\n <\/p>\n\nContexte<\/h2>\n
Le script\u00a0:<\/h2>\n
#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n Analyzes the state of a domain controller and reports any problems to help with troubleshooting. Optionally, set a WYSIWYG custom field.\r\n By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n.DESCRIPTION\r\n Analyzes the state of a domain controller and reports any problems to help with troubleshooting. Optionally, set a WYSIWYG custom field.\r\n.EXAMPLE\r\n (No Parameters)\r\n \r\nRetrieving Directory Server Diagnosis Test Results.\r\n\r\nPassing Tests: CheckSDRefDom, Connectivity, CrossRefValidation, DFSREvent, FrsEvent, Intersite, KccEvent, KnowsOfRoleHolders, MachineAccount, NCSecDesc, NetLogons, ObjectsReplicated, Replications, RidManager, Services, SystemLog, SysVolCheck, VerifyReferences\r\n\r\n[Alert] Failed Tests Detected!\r\nFailed Tests: Advertising, LocatorCheck\r\n\r\n### Detailed Output ###\r\n\r\nDirectory Server Diagnosis\r\nPerforming initial setup:\r\n Trying to find home server...\r\n Home Server = SRV16-DC2-TEST\r\n * Identified AD Forest. \r\n Done gathering initial info.\r\nDoing initial required tests\r\n Testing server: Default-First-Site-Name\\SRV16-DC2-TEST\r\n Starting test: Connectivity\r\n ......................... SRV16-DC2-TEST passed test Connectivity\r\nDoing primary tests\r\n Testing server: Default-First-Site-Name\\SRV16-DC2-TEST\r\n Starting test: Advertising\r\n Warning: SRV16-DC2-TEST is not advertising as a time server.\r\n ......................... SRV16-DC2-TEST failed test Advertising\r\n Running partition tests on : ForestDnsZones\r\n Running partition tests on : DomainDnsZones\r\n Running partition tests on : Schema\r\n Running partition tests on : Configuration\r\n Running partition tests on : test\r\n Running enterprise tests on : test.lan\r\n\r\nDirectory Server Diagnosis\r\nPerforming initial setup:\r\n Trying to find home server...\r\n Home Server = SRV16-DC2-TEST\r\n * Identified AD Forest. \r\n Done gathering initial info.\r\nDoing initial required tests\r\n Testing server: Default-First-Site-Name\\SRV16-DC2-TEST\r\n Starting test: Connectivity\r\n ......................... SRV16-DC2-TEST passed test Connectivity\r\nDoing primary tests\r\n Testing server: Default-First-Site-Name\\SRV16-DC2-TEST\r\n Running partition tests on : ForestDnsZones\r\n Running partition tests on : DomainDnsZones\r\n Running partition tests on : Schema\r\n Running partition tests on : Configuration\r\n Running partition tests on : test\r\n Running enterprise tests on : test.lan\r\n Starting test: LocatorCheck\r\n Warning: DcGetDcName(TIME_SERVER) call failed, error 1355\r\n A Time Server could not be located.\r\n The server holding the PDC role is down.\r\n Warning: DcGetDcName(GOOD_TIME_SERVER_PREFERRED) call failed, error\r\n 1355\r\n A Good Time Server could not be located.\r\n ......................... test.lan failed test LocatorCheck\r\n\r\nPARAMETER: -wysiwygCustomField \"ReplaceMeWithaWYSIWYGcustomField\"\r\n Name of a WYSIWYG custom field to optionally save the results to.\r\n.NOTES\r\n Minimum OS Architecture Supported: Windows 10, Windows Server 2016\r\n Release Notes: Initial Release\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n [Parameter()]\r\n [String]$wysiwygCustomField\r\n)\r\n\r\nbegin {\r\n # If script form variables are used, replace command line parameters with their value. \r\n if ($env:wysiwygCustomFieldName -and $env:wysiwygCustomFieldName -notlike \"null\") { $wysiwygCustomField = $env:wysiwygCustomFieldName }\r\n\r\n # Function to test if the current machine is a domain controller\r\n function Test-IsDomainController {\r\n $OS = if ($PSVersionTable.PSVersion.Major -lt 5) {\r\n Get-WmiObject -Class Win32_OperatingSystem\r\n }\r\n else {\r\n Get-CimInstance -ClassName Win32_OperatingSystem\r\n }\r\n\r\n # Check if the OS is a domain controller (ProductType 2)\r\n if ($OS.ProductType -eq \"2\") {\r\n return $true\r\n }\r\n }\r\n\r\n function Get-DCDiagResults {\r\n # Define the list of DCDiag tests to run\r\n $DCDiagTestsToRun = \"Connectivity\", \"Advertising\", \"FrsEvent\", \"DFSREvent\", \"SysVolCheck\", \"KccEvent\", \"KnowsOfRoleHolders\", \"MachineAccount\", \"NCSecDesc\", \"NetLogons\", \"ObjectsReplicated\", \"Replications\", \"RidManager\", \"Services\", \"SystemLog\", \"VerifyReferences\", \"CheckSDRefDom\", \"CrossRefValidation\", \"LocatorCheck\", \"Intersite\"\r\n \r\n foreach ($DCTest in $DCDiagTestsToRun) {\r\n # Run DCDiag for the current test and save the output to a file\r\n $DCDiag = Start-Process -FilePath \"DCDiag.exe\" -ArgumentList \"\/test:$DCTest\", \"\/f:$env:TEMP\\dc-diag-$DCTest.txt\" -PassThru -Wait -NoNewWindow\r\n\r\n # Check if the DCDiag test failed\r\n if ($DCDiag.ExitCode -ne 0) {\r\n Write-Host \"[Error] Running $DCTest!\"\r\n exit 1\r\n }\r\n\r\n # Read the raw results from the output file and filter out empty lines\r\n $RawResult = Get-Content -Path \"$env:TEMP\\dc-diag-$DCTest.txt\" | Where-Object { $_.Trim() }\r\n \r\n # Find the status line indicating whether the test passed or failed\r\n $StatusLine = $RawResult | Where-Object { $_ -match \"\\. .* test $DCTest\" }\r\n\r\n # Extract the status (passed or failed) from the status line\r\n $Status = $StatusLine -split ' ' | Where-Object { $_ -like \"passed\" -or $_ -like \"failed\" }\r\n\r\n # Create a custom object to store the test results\r\n [PSCustomObject]@{\r\n Test = $DCTest\r\n Status = $Status\r\n Result = $RawResult\r\n }\r\n\r\n # Remove the temporary output file\r\n Remove-Item -Path \"$env:TEMP\\dc-diag-$DCTest.txt\"\r\n }\r\n }\r\n\r\n function Set-NinjaProperty {\r\n [CmdletBinding()]\r\n Param(\r\n [Parameter(Mandatory = $True)]\r\n [String]$Name,\r\n [Parameter()]\r\n [String]$Type,\r\n [Parameter(Mandatory = $True, ValueFromPipeline = $True)]\r\n $Value,\r\n [Parameter()]\r\n [String]$DocumentName\r\n )\r\n \r\n $Characters = $Value | Out-String | Measure-Object -Character | Select-Object -ExpandProperty Characters\r\n if ($Characters -ge 200000) {\r\n throw [System.ArgumentOutOfRangeException]::New(\"Character limit exceeded: the value is greater than or equal to 200,000 characters.\")\r\n }\r\n \r\n # If requested to set the field value for a Ninja document, specify it here.\r\n $DocumentationParams = @{}\r\n if ($DocumentName) { $DocumentationParams[\"DocumentName\"] = $DocumentName }\r\n \r\n # This is a list of valid fields that can be set. If no type is specified, assume that the input does not need to be changed.\r\n $ValidFields = \"Attachment\", \"Checkbox\", \"Date\", \"Date or Date Time\", \"Decimal\", \"Dropdown\", \"Email\", \"Integer\", \"IP Address\", \"MultiLine\", \"MultiSelect\", \"Phone\", \"Secure\", \"Text\", \"Time\", \"URL\", \"WYSIWYG\"\r\n if ($Type -and $ValidFields -notcontains $Type) { Write-Warning \"$Type is an invalid type. Please check here for valid types: https:\/\/ninjarmm.zendesk.com\/hc\/en-us\/articles\/16973443979789-Command-Line-Interface-CLI-Supported-Fields-and-Functionality\" }\r\n \r\n # The field below requires additional information to set.\r\n $NeedsOptions = \"Dropdown\"\r\n if ($DocumentName) {\r\n if ($NeedsOptions -contains $Type) {\r\n # Redirect error output to the success stream to handle errors more easily if nothing is found or something else goes wrong.\r\n $NinjaPropertyOptions = Ninja-Property-Docs-Options -AttributeName $Name @DocumentationParams 2>&1\r\n }\r\n }\r\n else {\r\n if ($NeedsOptions -contains $Type) {\r\n $NinjaPropertyOptions = Ninja-Property-Options -Name $Name 2>&1\r\n }\r\n }\r\n \r\n # If an error is received with an exception property, exit the function with that error information.\r\n if ($NinjaPropertyOptions.Exception) { throw $NinjaPropertyOptions }\r\n \r\n # The types below require values not typically given to be set. The code below will convert whatever we're given into a format ninjarmm-cli supports.\r\n switch ($Type) {\r\n \"Checkbox\" {\r\n # Although it's highly likely we were given a value like \"True\" or a boolean data type, it's better to be safe than sorry.\r\n $NinjaValue = [System.Convert]::ToBoolean($Value)\r\n }\r\n \"Date or Date Time\" {\r\n # Ninjarmm-cli expects the GUID of the option to be selected. Therefore, match the given value with a GUID.\r\n $Date = (Get-Date $Value).ToUniversalTime()\r\n $TimeSpan = New-TimeSpan (Get-Date \"1970-01-01 00:00:00\") $Date\r\n $NinjaValue = $TimeSpan.TotalSeconds\r\n }\r\n \"Dropdown\" {\r\n # Ninjarmm-cli expects the GUID of the option we're trying to select, so match the value we were given with a GUID.\r\n $Options = $NinjaPropertyOptions -replace '=', ',' | ConvertFrom-Csv -Header \"GUID\", \"Name\"\r\n $Selection = $Options | Where-Object { $_.Name -eq $Value } | Select-Object -ExpandProperty GUID\r\n \r\n if (-not $Selection) {\r\n throw [System.ArgumentOutOfRangeException]::New(\"Value is not present in dropdown options.\")\r\n }\r\n \r\n $NinjaValue = $Selection\r\n }\r\n default {\r\n # All the other types shouldn't require additional work on the input.\r\n $NinjaValue = $Value\r\n }\r\n }\r\n \r\n # Set the field differently depending on whether it's a field in a Ninja Document or not.\r\n if ($DocumentName) {\r\n $CustomField = Ninja-Property-Docs-Set -AttributeName $Name -AttributeValue $NinjaValue @DocumentationParams 2>&1\r\n }\r\n else {\r\n $CustomField = $NinjaValue | Ninja-Property-Set-Piped -Name $Name 2>&1\r\n }\r\n \r\n if ($CustomField.Exception) {\r\n throw $CustomField\r\n }\r\n }\r\n \r\n function Test-IsElevated {\r\n $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n }\r\n\r\n if (!$ExitCode) {\r\n $ExitCode = 0\r\n }\r\n}\r\nprocess {\r\n # Check if the script is run with Administrator privileges\r\n if (!(Test-IsElevated)) {\r\n Write-Host -Object \"[Error] Access Denied. Please run with Administrator privileges.\"\r\n exit 1\r\n }\r\n\r\n # Check if the script is run on a Domain Controller\r\n if (!(Test-IsDomainController)) {\r\n Write-Host -Object \"[Error] This script needs to be run on a Domain Controller.\"\r\n exit 1\r\n }\r\n\r\n # Initialize lists to store passing and failing tests\r\n $PassingTests = New-Object System.Collections.Generic.List[object]\r\n $FailedTests = New-Object System.Collections.Generic.List[object]\r\n\r\n # Notify the user that the tests are being retrieved\r\n Write-Host -Object \"`nRetrieving Directory Server Diagnosis Test Results.\"\r\n $TestResults = Get-DCDiagResults\r\n\r\n # Process each test result\r\n foreach ($Result in $TestResults) {\r\n $TestFailed = $False\r\n\r\n # Check if any status in the result indicates a failure\r\n $Result.Status | ForEach-Object {\r\n if ($_ -notmatch \"pass\") {\r\n $TestFailed = $True\r\n }\r\n }\r\n\r\n # Add the result to the appropriate list\r\n if ($TestFailed) {\r\n $FailedTests.Add($Result)\r\n }\r\n else {\r\n $PassingTests.Add($Result)\r\n }\r\n }\r\n\r\n # Optionally set a WYSIWYG custom field if specified\r\n if ($wysiwygCustomField) {\r\n try {\r\n Write-Host -Object \"`nBuilding HTML for Custom Field.\"\r\n\r\n # Create an HTML report for the custom field\r\n $HTML = New-Object System.Collections.Generic.List[object]\r\n\r\n $HTML.Add(\"<h1 style='text-align: center'>Directory Server Diagnosis Test Results (DCDiag.exe)<\/h1>\")\r\n $FailedPercentage = $([math]::Round((($FailedTests.Count \/ ($FailedTests.Count + $PassingTests.Count)) * 100), 2))\r\n $SuccessPercentage = 100 - $FailedPercentage\r\n $HTML.Add(\r\n @\"\r\n<div class='p-3 linechart'>\r\n <div style='width: $FailedPercentage%; background-color: #C6313A;'><\/div>\r\n <div style='width: $SuccessPercentage%; background-color: #007644;'><\/div>\r\n <\/div>\r\n <ul class='unstyled p-3' style='display: flex; justify-content: space-between; '>\r\n <li><span class='chart-key' style='background-color: #C6313A;'><\/span><span>Failed ($($FailedTests.Count))<\/span><\/li>\r\n <li><span class='chart-key' style='background-color: #007644;'><\/span><span>Passed ($($PassingTests.Count))<\/span><\/li>\r\n <\/ul>\r\n\"@\r\n )\r\n\r\n # Add failed tests to the HTML report\r\n $FailedTests | Sort-Object Test | ForEach-Object {\r\n $HTML.Add(\r\n @\"\r\n<div class='info-card error'>\r\n <i class='info-icon fa-solid fa-circle-exclamation'><\/i>\r\n <div class='info-text'>\r\n <div class='info-title'>$($_.Test)<\/div>\r\n <div class='info-description'>\r\n $($_.Result | Out-String)\r\n <\/div>\r\n <\/div>\r\n<\/div>\r\n\"@\r\n )\r\n }\r\n\r\n # Add passing tests to the HTML report\r\n $PassingTests | Sort-Object Test | ForEach-Object {\r\n $HTML.Add(\r\n @\"\r\n<div class='info-card success'>\r\n <i class='info-icon fa-solid fa-circle-check'><\/i>\r\n <div class='info-text'>\r\n <div class='info-title'>$($_.Test)<\/div>\r\n <div class='info-description'>\r\n Test passed.\r\n <\/div>\r\n <\/div>\r\n<\/div>\r\n\"@\r\n )\r\n }\r\n\r\n # Set the custom field with the HTML report\r\n Write-Host -Object \"Attempting to set Custom Field '$wysiwygCustomField'.\"\r\n Set-NinjaProperty -Name $wysiwygCustomField -Value $HTML\r\n Write-Host -Object \"Successfully set Custom Field '$wysiwygCustomField'!\"\r\n }\r\n catch {\r\n Write-Host -Object \"[Error] $($_.Exception.Message)\"\r\n $ExitCode = 1\r\n }\r\n }\r\n\r\n # Display the list of passing tests\r\n if ($PassingTests.Count -gt 0) {\r\n Write-Host -Object \"\"\r\n Write-Host -Object \"Passing Tests: \" -NoNewline\r\n Write-Host -Object ($PassingTests.Test | Sort-Object) -Separator \", \"\r\n Write-Host -Object \"\"\r\n }\r\n\r\n # Display the list of failed tests with detailed output\r\n if ($FailedTests.Count -gt 0) {\r\n Write-Host -Object \"[Alert] Failed Tests Detected!\"\r\n Write-Host -Object \"Failed Tests: \" -NoNewline\r\n Write-Host -Object ($FailedTests.Test | Sort-Object) -Separator \", \"\r\n\r\n Write-Host -Object \"`n### Detailed Output ###\"\r\n $FailedTests | Sort-Object Test | ForEach-Object {\r\n Write-Host -Object \"\"\r\n Write-Host -Object ($_.Result | Out-String)\r\n Write-Host -Object \"\"\r\n }\r\n }\r\n else {\r\n Write-Host -Object \"All Directory Server Diagnosis Tests Pass!\"\r\n }\r\n\r\n exit $ExitCode\r\n}\r\nend {\r\n \r\n \r\n \r\n}<\/pre>\n