← ALL SCRIPTS PowerShell · v1.1 · Read-only

Invoke-ADHealthCheck

Comprehensive read-only Active Directory health assessment. 18 diagnostic checks across the forest, domain controllers, replication, DNS, services and AD hygiene — producing a styled HTML report, a CSV summary, and (optionally) emailing both to a distribution list with a status-coded subject line.

Designed for hybrid environments and large multi-domain forests. WinRM is not required — remote data collection uses RPC-based protocols only (CIM-over-DCOM, native dcdiag/repadmin/dfsrdiag tooling). Reports default to a AD-HealthCheck-Reports\ subdirectory under the script’s folder, and historical reports accumulate over time.

What it checks
  • Forest & domain inventory
  • FSMO role holders
  • Domain controller inventory
  • DCDiag (20 tests, per DC)
  • Replication health
  • Critical AD services per DC
  • DNS & SRV records
  • Time sync (W32Time)
  • SYSVOL / NETLOGON
  • Tombstone & recycle bin
  • Privileged group membership (with names)
  • Stale user accounts (with names)
  • Stale computer accounts (with names)
  • Password policies (Default + FGPP)
  • Trust relationships
  • GPO inventory + unlinked (with names)
  • DC event log critical errors (last 24h)
  • Disk free space on DCs
PowerShell 5.1+ RSAT-AD Read-only HTML + CSV SMTP email No WinRM needed Multi-domain
Get Script on GitHub

Opens github.com/rt109048/Invoke-ADHealthCheck in a new tab

Get in touch

Let’s talk identity.

Open to advisory, contract and permanent opportunities involving Active Directory, Entra ID, identity governance, or zero-trust programmes. The best way to reach me is by email.

Location
United States — Remote