In this article, we will discuss the “Preliminary Guide for Active Directory and Initial Assessment”. Before performing any migration, security hardening, troubleshooting, or architectural changes, it is essential to conduct a preliminary analysis of the Active Directory (AD) environment. Please, see the “Preliminary Guide for WSUS Analysis and Initial Assessment“, How to backup Azure VM with VM Settings, and “What is ADK, MDT, Microsoft Endpoint Configuration Manager (SCCM), Intune, Autopilot, and WSUS“.

This initial assessment provides visibility into the domain structure, domain controllers, users, computers, Group Policy Objects (GPOs), DNS configuration, and replication health.

The following guide outlines a set of PowerShell commands that can be used to gather key information about an Active Directory infrastructure.

All commands must be executed from PowerShell with administrative privileges and require the ActiveDirectory and GroupPolicy modules to be available on the system.

Preliminary Active Directory Analysis

Note: The following commands must be executed from PowerShell as Administrator.

Also, see How to check the version of Windows ADK, How to Disable the Password Manager of Google Chrome, and How to backup Azure VM with VM Settings.

Domain Verification and Basic Information

Domain name and functional level

Get-ADDomain | Select-Object Name, DistinguishedName, DomainMode

Active Domain Controllers (DCs)

Get-ADDomainController -Filter * | Select-Object Name, IPv4Address, Site, IsGlobalCatalog

Users and Groups

List all users in the domain

Get-ADUser -Filter * | Select-Object SamAccountName, Name, Enabled, LastLogonDate

This command helps identify:

Disabled or inactive accounts
Accounts that have not logged in recently
General user population size

List all computers in the domain

Get-ADComputer -Filter * | Select-Object Name, OperatingSystem, LastLogonDate

Useful for:

Identifying obsolete machines
Verifying operating system versions
Detecting inactive computer accounts

Please, see how to download and install the Windows ADK Patches, Procedure for creating an MSSQL Always On Cluster on Azure, and Unable to edit MDT XML unattended file: Could not load file.

Group Policy Objects (GPO)

List all GPOs

Get-GPO -All | Select-Object DisplayName, GpoStatus, CreationTime

This provides insight into:

Active vs disabled GPOs
Policy sprawl
Age and lifecycle of existing policies

DNS Infrastructure Information

Verify DNS records. Run the following command for each domain zone (e.g., domain.com):

Get-DnsServerResourceRecord -ZoneName "domain.com" -ComputerName "DCName"

DNS is critical for AD health. This step helps validate:

Correct record registration
Presence of stale or missing records
Proper DC name resolution

Domain Organisation Information

Forest and domain structure

Get-ADForest | Select-Object ForestMode, Domains, GlobalCatalogs

This command provides:

Forest functional level
List of domains in the forest
Global Catalog placement

Please, see “What is ADK, MDT, Microsoft Endpoint Configuration Manager (SCCM), Intune, Autopilot, and WSUS“, and Guide Backup Azure Kubernetes Service by using Azure Backup.

Sites and Services Configuration

List AD sites

Get-ADSite | Select-Object Name

Domain Controllers per site

Get-ADDomainController -Filter * | Select-Object Name, Site

These commands help verify:

Proper site configuration
Correct DC placement
Alignment with network topology

Replication Configuration

The replication partners between DCs

Get-ADReplicationPartnerMetadata -Target * | Select-Object Server, Partner, Site, LastReplicationSuccess

Replication status summary

Get-ADReplicationSummary

These checks are essential to detect:

Replication failures
Latency issues
Site-to-site replication problems

Complete Replication Configuration Report

Detailed replication report

repadmin /showrepl > C:\Temp\ReplicaReport.txt

This command generates a comprehensive replication report, useful for:

Audits
Troubleshooting
Documentation and change management

Please, see Enhanced Proactive Monitoring with Veeam ONE, SQL Server 2025 Upgrade Requirements and Compatibility, and Upgrade Veeam Backup and Replication v12.3 to v13 on Windows.

Conclusion

A preliminary Active Directory analysis is a foundational step for maintaining a healthy, secure, and scalable directory service.

By systematically collecting domain, user, computer, policy, DNS, site, and replication data, administrators gain the insights required to make informed decisions and proactively address potential issues.

This guide can serve as a baseline checklist for audits, migrations, or ongoing operational reviews.

I hope you found this guide on “Preliminary Guide for Active Directory and Initial Assessment” very useful. Please, feel free to leave a comment below.

Rate this post