When Active Directory breaks, the whole domain feels it — logons fail, Group Policy stops applying, and dependent services fall over. At the centre is NTDS, the database (ntds.dit) every domain controller runs. Recovery means working outward from the service, to replication, to the database itself.
1. Are the core services running?
Get-Service NTDS, Netlogon, DNS, KDC, w32time # an unresponsive directory service often just needs a restart # of the stuck service by name, e.g.: Restart-Service -Name <ServiceName>
NTDS (the directory), Netlogon (authentication), and DNS are the critical trio — AD is utterly dependent on DNS, so check it early (see DNS troubleshooting).
2. Check replication health
If one DC is out of sync, repadmin /replsummary and dcdiag /v show replication failures and which tests fail. These are your first stop for "logons work on one DC but not another."
3. Repair a broken secure channel
A member server or DC with a broken trust relationship to the domain shows the classic "trust relationship between this workstation and the primary domain failed." Test and repair without re-joining:
Test-ComputerSecureChannel -Verbose Test-ComputerSecureChannel -Repair -Credential (Get-Credential)
4. Recover the NTDS database
If NTDS itself is corrupt and won't start, boot into Directory Services Repair Mode (DSRM) and use ntdsutil: check integrity with files integrity, run a semantic database analysis, and only then repair. The safest recovery is almost always an authoritative or non-authoritative restore from a system-state backup — so confirm you have one before touching the live database.
Practise Windows incidents
AD sync failures, NTDS outages, and broken trust relationships are among the Windows Server incidents in the simulator. Work them in a full incident response shift.