Diagnosing Problems Arising from Active Directory Issues

Exchange Server 2003, like Exchange 2000 Server, is highly dependent on Active Directory for its functions. When Exchange Server 2003 is installed, the size of the Windows Server 2003 schema approximately doubles. The ability to diagnose problems between Exchange Server 2003 and Active Directory is vital to ensuring that the network runs efficiently and well.

Diagnosing Problems with the Global Catalog Server

Exchange Server 2003 is highly dependent on the global catalog server. If the incoming mail queue is becoming unmanageably large, it might be because there are problems with the global catalog server.

To diagnose whether a global catalog server is the cause of a lengthening incoming mail queue, check the following counters on the Exchange Server 2003 computer in the Performance console:

• SMTP Server\Categorizer Queue Length Provides an indication of how successfully SMTP is processing Lightweight Directory Access Protocol (LDAP) queries against the global catalog server. This counter should not exceed 10 for protracted periods. If it steadily rises, it indicates that the global catalog servers are not responding quickly to requests.

• MSExchangeDSAccess Process\LDAP Read Time Provides information on the amount of time that an LDAP read request takes to be fulfilled. This value should not average more than 60ms.

• MSExchangeDSAccess Process\LDAP Search Time Similar to the preceding counter, though this counter deals with LDAP queries rather than read requests. This value should not average more than 60ms.

If the global catalog server is performing badly, it might be because it is not located on the local network, or that it is simply overloaded. In either case, installing another global catalog server on the local network should help reduce the size of the categorizer queue length.

DCDiag

DCDiag is a utility that you would have already run if you used the Exchange Server Deployment Tools checklist.

It requires domain administrator and local administrator rights on the computer on which it is run. DCDiag is used to analyze the state of domain controllers in the forest and reports any problems that it finds.

Installing DCDiag

If you did not follow the Exchange Server Deployment Tools installation checklist, you can install the Windows Server 2003 support tools (or the equivalent version for Windows 2000 Server) by installing the suptools.msi file in the \support\tools folder of your Windows Server 2003 (or Windows 2000 Server) installation media.

Tests That DCDiag Performs

The following is the syntax for running DCDiag:

 dcdiag /s:domain_controller 

In the preceding syntax, domain_controller is the DC you want to run DCDiag against. When DCDiag is run, it performs the following tests that can be useful in determining if the DC that Exchange Server 2003 is using is suffering from any problems:

• Connectivity Checks whether the domain controller is correctly registered in DNS, whether it can be pinged, and whether it has LDAP and RPC connectivity

• Replications Checks for replication errors between DCs

• NetLogons Checks that permissions are configured to allow replication to proceed

• Advertising Checks that the roles assigned to the DC are being correctly advertised to the network

• KnowsOfRoleHolders Checks that the DC can contact the five Flexible Single Master Operation (FSMO) role holders

• Services Checks that appropriate DC services are running

• VerifyReplicas Checks that AD replica partitions are functioning; this is very useful for AD integrated DNS servers

If some of the DCDiag checks fail, it shows you the next avenue that you need to pursue in diagnosing the exact problem that Exchange Server 2003 is having with the Active Directory infrastructure.

The Active Directory Connector

The Active Directory Connector (ADC) is used as a bridge between Exchange Server 5.5, Active Directory, and Exchange Server 2003. Often when the ADC is configured, there are teething problems. To diagnose these problems, you can configure logging on a connection-by-connection basis. These logs are written to the Windows event log. Logging can be configured at four levels. These levels are None, Minimum, Medium, and Maximum. The ADC categories that can be logged are

• Replication

• Account Management

• Attribute Mapping

• Service Controller

• LDAP Operations

If you suspect that a problem exists in one particular aspect of a connection agreement, you can tailor your logging so that, for example, Attribute Mapping is logged at the maximum rate while the other categories are not logged at all. Active Directory Connector problems are only going to exist in environments in which Exchange Server 5.5 is installed. It is important to note that there are three versions of the ADC, the Windows 2000 Server, Exchange 2000 Server, and Exchange Server 2003 versions. You should always update all versions of the ADC in use to the one provided with Exchange Server 2003.