Search code examples
powershellactive-directorypowershell-2.0directoryservices

Active Directory / Powershell - How to identify if a server, in a federated cluster, is down


This question is in the context of a service that is running on a DC server (or is accessing the DC remotely) such that the service can access Active Directory, but the service has no awareness of the Active Directory servers, how many servers there should be, what the server addresses are, etc...

Furthermore, the service must be written under the assumption that the Active Directory setup could involve a group of Federated servers.

So to illustrate the problem by way of an example -

Say I'm trying to run a very simple AD query, via Powershell v2 (or you could use Directory Services), to get all of the ADUsers:

$users = Get-ADUser

Now let's assume that the example company, Contoso, has an AD server in New York (for their NY office), and one in Seattle (for their Seattle office). Also, the service will be pointing to the DC which will be the server in the NY data center.

So for the purposes of simplicity, let's just say that $users returns two user objects with display-name attributes of:

Dan Jump Jim Wilson

Now let's assume that the Seattle server is down so I run the query again and just get:

Dan Jump

From what I understand - AD will not return an error indicating that the Seattle server is down..it will just return the users it can find..

I know it's possible to detect deleted objects so, if I saved a list of all the users, I could potentially verify that the user was deleted...but that's a bit of overhead especially if I'm interested in more than just a list of users

So is there a way to detect one or more AD servers, in a Federated cluster, are down before I even run my query?


Solution

  • You might like to read this, before you make use of any of the following. S.DS and S.DS.AD abstract a lot of what happens but there's a lot of useful information in there and it might help you to clarify your requirements.

    I'm not aware that there's a function to return DCs that are down but the System.DirectoryServices.ActiveDirectory namespace contains classes you need to determine domain topology. For example, the Forest class will return a collection of Domain objects (and Sites and many other useful properties). Domain will give you access to a collection of DomainController objects( as well as the Children and Parent domains and many other props and methods).

    You could iterate over the domains to get all DCs and then iterate over the DCs and try a ping although this may not work in a well-secured and segmented network. You might consider trying to connect to each DC using S.DS.DirectoryEntry as that should work, from a DC, in any scenario. Of course, if your network guys have been overzealous with their locking-down, even that might not work.