dcdiag i f server 2012 - … 13, 2014 · 1 introduction: dcdiag one of the powerful tools for...
TRANSCRIPT
DCDIAG IMPORTED FUNCTIONS– SERVER 2012
Prepared By
Sainath K.E.V
Microsoft MVP –Directory Services
Dated: 13/04/2014
TABLE OF CONTENTS
1 Introduction: ......................................................................................................................................... 3
2 Technical Details: ................................................................................... Error! Bookmark not defined.
2.1 Scenario1: ...................................................................................... Error! Bookmark not defined.
2.2 Scenario2: ...................................................................................... Error! Bookmark not defined.
2.3 Scenario 3 ....................................................................................... Error! Bookmark not defined.
2.4 Win32 Time Modules .................................................................................................................... 7
2.4.1 Function Details .................................................................................................................... 8
1 INTRODUCTION:
DCDIAG one of the powerful tools for Active Directory Administrators and it’s a trouble-saver for most
painful issues related to Active Directory infrastructure. For any troubleshooting, the first request from
Microsoft or either in the forums is to produce DCDIAG / <switches> output ( Eg: DcDiag /V or /e ) which
helps in validating the Active Directory infrastructure data.
Microsoft TechNet and Forums provides exceeded information about DcDiag usage and scenarios, this
article addresses underlying building blocks which makes DcDiag to work. This article lists different
Dynamic Link Libraries and all the imported function calls used in DcDiag.
2 TECHNICAL DETAILS
DcDiag utility analyzes Domain controller’s state in an Active Directory Forest and reports back
configuration information and errors. DcDiag runs different tests to provide detail information to
Administrators, below are the tests
Advertising : checks whether DSA is advertising itself
CheckSDRefdom: Checks all Application directory partitions have appropriate security
descriptor reference domains.
CheckSecurityError: Checks security errors and performs initial diagnosis of the problem.
Connectivity: Tests whether DSAs are DNS registered and responding to LDAP / RPC
connectivity
CrossRefValidation: checks for invalid cross-references
CutoffServers: Checks for servers that won’t receive replications because its partners are
down
DcPromo: Tests the existing DNS infrastructure for promotion of Domain Controller. If
the infrastructure is sufficient, the computer can be promoted to DC in an Active
directory domain.
DNS: Checks the health of DNS settings for the whole enterprise. This test further has
subtests that can be performed to check Forwarders, Dynamic Updates, Delegation etc..
FrsEvent: This test checks to see if there are any operation errors in the FRS
DFSREvent: This test checks to see if there are any operation errors in the DFS
SysVolCheck: Checks SYSVOL is ready
LocatorCheck: Checks for global role-holders status and whether they can be located
Intersite: Checks for failures that would prevent or temporarily hold up intersite
replication
KccEvent: This test checks KCC is completing without errors
KnowsOfRoleHolders: Checks whether the DSA know its role holders
MachineAccount: Checks to see if the Machine Account has the proper information
NCSecDesc: checks the Security Descriptors on the naming context have appropriate
permissions for replication
Netlogons: Checks that the approrpirate logon privileges allow replication to proceed
ObjectsReplicated: Checks the Machine Account and DSA objects have replicated
OutboundSecureChannels: Checks for the Secure Channels from all of the DC’s in the
domain
RegisterDNS: Tests whether the directory server can register the directory server locator
DNS records
Replications: Checks for timely replication between directory servers
RidManager: Check to see if RID master is accessable
Services: Check to see if all the required AD services are running
SystemLog: Checks that the system is running without errors
Topology: Checks that the generated topology is fully connected for all DSA’s
VerifyEnterpriseReference: This test verifys that certain System references are intact for
the FRS and Replication infrastructure
VerifyReferences: Verifies that certain system references are intact for the FRS and
Replication infrastructure
VerifyReplicas: This test verifies that all application directory partition are fully
instantiated on all replica servers
Administrators can use different switches with the use of DcDiag, please follow the below link
http://technet.microsoft.com/en-us/library/cc731968.aspx
3 DCDIAG MODULES
This section will describe the major module imported by DcDiag executable which will be required for
understanding of DcDiag functionality.
Components: DcDiag.exe – executable
When DcDiag runs, it imports a series of modules which are responsible for displaying information with
DcDiag
ADVAPI32 IPHLPAPI Kernel 32
NetAPI32 NTDSAPI32.dll Shell32.dll
User32.dll WS2_32 Msvcrt.dll
DNSAPI
MPR
OLEAUT32 RPCRT4 WLDAP32 Ntdll.dll
Ole32.dll
wevtapi
3.1.1 DCD IAG IMPORT FUNCTION DETAILS
Below are the list of functions used by different imported modules. This list is extremely useful when
understanding DcDiag functionality and for advance troubleshooting. These modules when paired /
graphed together will provide DcDiag Architectural implementation detailis. Below function are not
documented in TechNet, these are learnt from by debugging the DcDiag and validating different dumps
to analyse the stack and functions imported by DcDiag executable.
Below list provides rich list of functions imported by DcDiag. There are 343 + functions used by DcDiag.
Function Name Module
OpenServiceW ADVAPI32
ImpersonateLoggedOnUser ADVAPI32
LsaQueryTrustedDomainInfoByName ADVAPI32
QueryServiceConfigW ADVAPI32
QueryServiceStatus ADVAPI32
LsaSetSecret ADVAPI32
FreeSid ADVAPI32
ReadEventLogW ADVAPI32
OpenEventLogW ADVAPI32
RegConnectRegistryW ADVAPI32
LsaOpenSecret ADVAPI32
GetNumberOfEventLogRecords ADVAPI32
RevertToSelf ADVAPI32
EnumDependentServicesW ADVAPI32
AllocateAndInitializeSid ADVAPI32
CloseEventLog ADVAPI32
EqualSid ADVAPI32
CloseServiceHandle ADVAPI32
GetAce ADVAPI32
OpenSCManagerW ADVAPI32
ControlService ADVAPI32
ConvertSecurityDescriptorToStringSecurityDescriptorW ADVAPI32
ConvertSidToStringSidW ADVAPI32
StartServiceW ADVAPI32
IsValidSid ADVAPI32
GetLengthSid ADVAPI32
LsaQueryInformationPolicy ADVAPI32
LsaOpenPolicy ADVAPI32
LsaFreeMemory ADVAPI32
LsaEnumerateAccountsWithUserRight ADVAPI32
LsaClose ADVAPI32
LookupAccountSidW ADVAPI32
LogonUserW ADVAPI32
DnsModifyRecordsInSet_W DNSAPI
DnsQueryConfig DNSAPI
DnsQuery_W DNSAPI
DnsNameCompare_W DNSAPI
DnsUpdateTest_W DNSAPI
DnsValidateName_W DNSAPI
DnsFlushResolverCacheEntry_W DNSAPI
DnsFree DNSAPI
IcmpCreateFile IPHLPAPI
IcmpCloseHandle IPHLPAPI
Icmp6CreateFile IPHLPAPI
GetUnicastIpAddressTable IPHLPAPI
Icmp6SendEcho2 IPHLPAPI
GetAdaptersAddresses IPHLPAPI
GetIfEntry2 IPHLPAPI
FreeMibTable IPHLPAPI
IcmpSendEcho2 IPHLPAPI
RegOpenKeyExW KERNEL32
RegQueryValueExW KERNEL32
ReleaseMutex KERNEL32
CloseHandle KERNEL32
CompareFileTime KERNEL32
CreateEventW KERNEL32
CreateFileW KERNEL32
CreateThread KERNEL32
DeleteCriticalSection KERNEL32
lstrlenW KERNEL32
EnterCriticalSection KERNEL32
ExpandEnvironmentStringsW KERNEL32
FileTimeToLocalFileTime KERNEL32
FileTimeToSystemTime KERNEL32
FreeLibrary KERNEL32
GetComputerNameExA KERNEL32
GetComputerNameExW KERNEL32
GetComputerNameW KERNEL32
GetConsoleMode KERNEL32
GetConsoleOutputCP KERNEL32
GetConsoleScreenBufferInfo KERNEL32
GetCurrentProcess KERNEL32
GetCurrentProcessId KERNEL32
GetCurrentThreadId KERNEL32
GetDateFormatW KERNEL32
GetLastError KERNEL32
CompareStringW KERNEL32
GetModuleHandleExW KERNEL32
GetModuleHandleW KERNEL32
GetProcAddress KERNEL32
GetProcessHeap KERNEL32
GetStdHandle KERNEL32
GetSystemTime KERNEL32
GetSystemTimeAsFileTime KERNEL32
GetTickCount KERNEL32
GetTimeFormatW KERNEL32
GetTimeZoneInformation KERNEL32
HeapFree KERNEL32
GetModuleHandleA KERNEL32
InitializeCriticalSection KERNEL32
InterlockedCompareExchange KERNEL32
InterlockedDecrement KERNEL32
InterlockedExchange KERNEL32
InterlockedIncrement KERNEL32
LeaveCriticalSection KERNEL32
LoadLibraryExW KERNEL32
LocalAlloc KERNEL32
LocalFree KERNEL32
LocalReAlloc KERNEL32
LocalSize KERNEL32
OutputDebugStringA KERNEL32
WriteFile KERNEL32
WideCharToMultiByte KERNEL32
WaitForSingleObject KERNEL32
WaitForMultipleObjects KERNEL32
QueryPerformanceCounter KERNEL32
MultiByteToWideChar KERNEL32
RaiseException KERNEL32
ReadConsoleW KERNEL32
FormatMessageW KERNEL32
ResetEvent KERNEL32
RegCloseKey KERNEL32
UnhandledExceptionFilter KERNEL32
TerminateProcess KERNEL32
SystemTimeToTzSpecificLocalTime KERNEL32
SystemTimeToFileTime KERNEL32
RegEnumKeyExW KERNEL32
Sleep KERNEL32
SetUnhandledExceptionFilter KERNEL32
SetThreadUILanguage KERNEL32
SetLastError KERNEL32
SetEvent KERNEL32
SetConsoleMode KERNEL32
WNetGetResourceInformationW MPR
WNetCancelConnection2W MPR
WNetAddConnection2W MPR
NetApiBufferFree NETAPI32
NetRemoteTOD NETAPI32
NetUserGetInfo NETAPI32
NetUserSetInfo NETAPI32
I_NetLogonControl2 NETAPI32
DsRoleFreeMemory NETAPI32
DsGetDcNameW NETAPI32
DsRoleGetPrimaryDomainInformation NETAPI32
DsReplicaAddW NTDSAPI
DsMakeSpnW NTDSAPI
DsListRolesW NTDSAPI
DsIsMangledDnW NTDSAPI
DsFreeNameResultW NTDSAPI
DsCrackNamesW NTDSAPI
DsReplicaSyncW NTDSAPI
DsReplicaSyncAllW NTDSAPI
DsReplicaGetInfo2W NTDSAPI
DsReplicaGetInfoW NTDSAPI
DsReplicaFreeInfo NTDSAPI
DsWriteAccountSpnW NTDSAPI
VariantInit OLEAUT32
VariantChangeType OLEAUT32
SysFreeString OLEAUT32
SysAllocString OLEAUT32
SafeArrayUnaccessData OLEAUT32
SafeArrayAccessData OLEAUT32
VariantClear OLEAUT32
RpcErrorStartEnumeration RPCRT4
RpcErrorGetNextRecord RPCRT4
RpcErrorEndEnumeration RPCRT4
RpcEpResolveBinding RPCRT4
RpcBindingToStringBindingW RPCRT4
RpcBindingSetOption RPCRT4
RpcBindingSetAuthInfoExW RPCRT4
RpcBindingSetAuthInfoExA RPCRT4
RpcBindingSetAuthInfoA RPCRT4
RpcBindingFromStringBindingW RPCRT4
RpcBindingFree RPCRT4
NdrClientCall2 RPCRT4
I_RpcGetExtendedError RPCRT4
I_RpcExceptionFilter RPCRT4
UuidToStringW RPCRT4
UuidFromStringW RPCRT4
RpcStringFreeW RPCRT4
RpcStringBindingParseW RPCRT4
RpcStringBindingComposeW RPCRT4
RpcMgmtEpEltInqNextW RPCRT4
RpcMgmtEpEltInqDone RPCRT4
RpcMgmtEpEltInqBegin RPCRT4
RpcIfInqId RPCRT4
LoadStringW USER32
ldap_result2error WLDAP32
ldap_modify_sW WLDAP32
ldap_msgfree WLDAP32
ldap_next_attributeW WLDAP32
ldap_next_entry WLDAP32
LdapMapErrorToWin32 WLDAP32
LdapGetLastError WLDAP32
ldap_search_abandon_page WLDAP32
ldap_explode_dnW WLDAP32
ldap_search_ext_sW WLDAP32
ldap_search_init_pageW WLDAP32
ldap_search_sW WLDAP32
ldap_set_optionW WLDAP32
ldap_get_dnW WLDAP32
ldap_first_entry WLDAP32
ldap_first_attributeW WLDAP32
ldap_unbind WLDAP32
ldap_err2stringW WLDAP32
ldap_count_values_len WLDAP32
ldap_count_valuesW WLDAP32
ldap_value_freeW WLDAP32
ldap_count_entries WLDAP32
ldap_bind_sW WLDAP32
ldap_value_free_len WLDAP32
ldap_add_sW WLDAP32
ldap_get_next_page_s WLDAP32
ldap_get_optionW WLDAP32
ldap_get_valuesW WLDAP32
ldap_get_values_lenW WLDAP32
ldap_initW WLDAP32
ldap_memfreeW WLDAP32
WSALookupServiceNextW WS2_32
getprotobyname WS2_32
WSASetLastError WS2_32
WSAStartup WS2_32
WSACleanup WS2_32
getaddrinfo WS2_32
getnameinfo WS2_32
freeaddrinfo WS2_32
GetNameInfoW WS2_32
FreeAddrInfoW WS2_32
closesocket WS2_32
GetAddrInfoW WS2_32
inet_ntoa WS2_32
inet_addr WS2_32
WSAGetLastError WS2_32
WSAIoctl WS2_32
WSALookupServiceBeginW WS2_32
WSALookupServiceEnd WS2_32
ntohs WS2_32
socket WS2_32
__wgetmainargs msvcrt
_amsg_exit msvcrt
_atoi64 msvcrt
_callnewh msvcrt
_cexit msvcrt
_controlfp msvcrt
_except_handler4_common msvcrt
_exit msvcrt
_fcloseall msvcrt
_ftol2_sse msvcrt
_initterm msvcrt
_iob msvcrt
_local_unwind4 msvcrt
_lock msvcrt
_onexit msvcrt
_purecall msvcrt
_snwprintf_s msvcrt
_stricmp msvcrt
_strupr msvcrt
_ultoa msvcrt
_unlock msvcrt
_vsnprintf msvcrt
_vsnwprintf msvcrt
_wcsdup msvcrt
_wcsicmp msvcrt
_wcsnicmp msvcrt
_wfopen msvcrt
_wtoi msvcrt
_wtoi64 msvcrt
_wtol msvcrt
atoi msvcrt
__p__fmode msvcrt
exit msvcrt
fflush msvcrt
free msvcrt
fwprintf msvcrt
iswdigit msvcrt
iswxdigit msvcrt
_ltow msvcrt
wcstoul msvcrt
wcstombs msvcrt
wcstol msvcrt
wcsstr msvcrt
wcsncpy_s msvcrt
wcsncmp msvcrt
wcscspn msvcrt
wcscpy_s msvcrt
wcschr msvcrt
wprintf msvcrt
wcscat_s msvcrt
vswprintf_s msvcrt
towupper msvcrt
towlower msvcrt
_CxxThrowException msvcrt
_XcptFilter msvcrt
__CxxFrameHandler3 msvcrt
__dllonexit msvcrt
__p__commode msvcrt
malloc msvcrt
mbstowcs msvcrt
memchr msvcrt
memcpy msvcrt
memcpy_s msvcrt
memmove msvcrt
memmove_s msvcrt
memset msvcrt
__set_app_type msvcrt
printf msvcrt
putchar msvcrt
qsort msvcrt
realloc msvcrt
setlocale msvcrt
__setusermatherr msvcrt
sprintf_s msvcrt
strncmp msvcrt
strtoul msvcrt
swprintf_s msvcrt
time msvcrt
?what@exception@@UBEPBDXZ msvcrt
?terminate@@YAXXZ msvcrt
??1type_info@@UAE@XZ msvcrt
??1exception@@UAE@XZ msvcrt
??0exception@@QAE@XZ msvcrt
??0exception@@QAE@ABV0@@Z msvcrt
??0exception@@QAE@ABQBD@Z msvcrt
RtlAllocateHeap ntdll
RtlSubAuthoritySid ntdll
RtlSubAuthorityCountSid ntdll
RtlGetDaclSecurityDescriptor ntdll
RtlFreeHeap ntdll
RtlNtStatusToDosError ntdll
RtlLengthSid ntdll
RtlIpv6StringToAddressW ntdll
RtlIpv6StringToAddressExW ntdll
RtlIpv6AddressToStringExW ntdll
RtlIpv6AddressToStringA ntdll
RtlIpv4StringToAddressW ntdll
RtlIpv4StringToAddressExW ntdll
RtlIpv6StringToAddressA ntdll
RtlIpv4StringToAddressA ntdll
RtlIpv4AddressToStringExW ntdll
RtlInitUnicodeString ntdll
CoUninitialize ole32
CoSetProxyBlanket ole32
CoQueryProxyBlanket ole32
CoInitializeSecurity ole32
CoInitializeEx ole32
CoInitialize ole32
CoCreateInstance ole32