Home Directory Plugins Operating Systems Windows Active Directory (AD) Check

Search Exchange

Search All Sites

Nagios Live Webinars

Let our experts show you how Nagios can help your organization.

Contact Us

Phone: 1-888-NAGIOS-1
Email: sales@nagios.com


Remember Me

Active Directory (AD) Check

24 votes
Current Version
Last Release Date
Compatible With
  • Nagios 3.x
Check_AD.vbsOriginal Script
check_active_directory.vbsGerman edition by J.V.
check_ad.vbsLatest version. Merged all changes, fixes and enhancements into this edition
check_ad.txtDaniel Esteves has made some changes
check_ad.txtPhil Randal has made some changes
check_ad_french.vbs.txtFrench version by Alexandre Rigaud
check_ad_french.vbs.txtUpdated version by Alexandre Rigaud
Network Monitoring Software - Download Nagios XI
Log Management Software - Nagios Log Server - Download
Netflow Analysis Software - Nagios Network Analyzer - Download
Wrapper for dcdiag.exe for Active Directory monitoring written in VBS.

This is a re-work of a script originally found here: http://felipeferreira.net/?p=315&cpage=1#comments

Only tested with Nagios 3.2.3. It should work on any version which supports reporting back via NRPE etc. Let me know how it works for you and I'll update the listing.

Works on English windows and should / could work on German, French and Spanish (Your milage may vary)
Usage: (with or without //nologo)
cscript Check_AD.vbs //nologo
cscript Check_AD.vbs //nologo /test:advertising
cscript Check_AD.vbs /test:ridmanager,services,fsmocheck

Output examples: (If one or more tests fail, CRITICAL is used as I have no idea which of these should be WARNING vs. CRITICAL. I'm assuming any failure is bad. Very bad)

Sample outputs:
OK - ridmanager: OK. services: OK. fsmocheck: OK.

CRITICAL - ridmanager: OK. services: CRITICAL. fsmocheck: OK.

CRITICAL - services: OK. replications: OK. advertising: OK. fsmocheck: OK. ridmanager: OK. machineaccount: OK. CheckSDRefDom: OK. CheckSecurityError: OK. CheckSDRefDom: OK. CrossRefValidation: OK. CutoffServers: OK. FrsEvent: CRITICAL. DFSREvent: OK. SysVolCheck: OK. LocatorCheck: OK. Intersite: OK. KccEvent: OK. KnowsOfRoleHolders: OK. NetLogons: OK. ObjectsReplicated: OK. OutboundSecureChannels: OK. Topology: OK. VerifyReferences: OK. VerifyReplicas: OK. NCSecDesc: OK.

Use dcdiag.exe /? to find out what checks YOUR version of Windows/dcdiag supports. 5 default checks are hardcoded within the script if no /test parameter is used. I don't claim they all work on all version of windows.

Email me at the address within the script for bug fixes etc. Tested on W2K8 x86 and W2K3 x64 using NSClient++ 2010-05-27 and the NRPE module.


Update: check_active_directory should work on German Windows thanks to the work by Jonathan Vogt.

Update #2: Jonathan Vogt has updated his version to autodetect the Windows language, English or German, and run accordingly.

Update #3: I've merged JV's edition and added support for multipartition checks. I've left the old vbscripts in case of issues.

Update #4: Forgot to turn off verbose logging. Fixed.

Update #5: Daniel Esteves: "Fixed a problem alert for failed status and support for DNS test parameters". Download check_ad.txt file for DE's Version.

Update #6: Phil Randal: Fix multiline parsing. Added connectivity, sysvol, and kccevent tests and "dns /dnsbasic" check on 2008 and later. Tested on Windows 2003, 2008 R2, and 2012 R2 DCs

Update #7: Alexandre Rigaud added support for French OS.

Update #8: Alexandre Rigaud added support for initial Spanish OS ++

Thanks goes to those who provide updates and feedback.

Reviews (21)
Thanks for the script. I am getting the error with FSMO check

C:Program FilesNSClient++scripts>cscript.exe //NoLogo check_ad.vbs
CRITICAL - services: OK. replications: OK. advertising: OK. fsmocheck: CRITICAL. ridmanager: OK. machineaccount: OK.

If I run dcdiag /test:fsmocheck then my test is passed.
Any tip to fix this?
Hi all,
we tested the bug-Fix from itnate but the error with the missing ridmanager still occures.

Could you please provide anothjer solution?

Thanks in advance.
byitNate, July 5, 2018
The script was flawless for DCs from 2003 to 2016. However I also have a Read Only 2012 R2 DC and the DCDiag does not check or output RIDManger. So I made a slight modification to line 237:
'Set default status for each named test
for loop1 = 0 to (ubound(name)-1)
status(loop1) = "CRITICAL"
lock(loop1) = FALSE
cmd = cmd & "/test:" & name(loop1) & " "

'Set default status for each named test
for loop1 = 0 to (ubound(name)-1)
status(loop1) = "Not Checked"
lock(loop1) = FALSE
cmd = cmd & "/test:" & name(loop1) & " "

This will allow the check to return OK if the keyword of the check is not found. However labeling that check as "Not Checked" in the service text.
tirst of all thank you for your job, this script is perfect to check every domain controller in our network
There is only one small problem with ReadOnly Domain COntrolelrs, because the test RidManager should be skipped in this case. Dcdiag does not output anything for the test RidManager when is executed on a RDOC, so the script should detect this condition and skip the test.
Best regards
In response to:
I have the same problem than Jeremy B, dcdiag result is on 2 line instead of 1 and I have a critical error for fsmo check.

Change the default values for the English language (unless you want to test other languages):

'Lang dependend. Default is english
dim strOK : strOK = "?????? ???????? "
dim strNotOK : strNotOk = "?? ?????? ???????? "

The only remark, these values must be saved in the editor encoded OEM 866 and then we obtain the following:

'Lang dependend. Default is english
dim strOK : strOK = "??®©¤?­ ??®???? "
dim strNotOK : strNotOk = "­? ??®©¤?­ ??®???? "

In the end is required to type in a space, otherwise in the case of a long domain name ( in my case it’s 16 characters) will occur a line break and FsmoCheck will process incorrectly.
More exactly works correctly, but will process the result of incorrect.
This is clearly evident when you start c verbose = 1 and uncomment fields (remove in front quotes):
‘pt "lineout buffer '" & lineout & "'"
‘pt "lineout buffer appended '" & lineout & "'"
I can see what the script does when I run it manually, however when executed by nagios is it supposed to show more than OK space and a dash? I would think since the script spits out the status of each item being checked it would show those results in the Status Information. How I'm configured:

In NSClient.ini under external scripts:
actived=cscript.exe //T:30 //NoLogo scripts\\check_ad.vbs $ARG1

In commands.cfg:

define command{
command_name check_nrpe
command_line /usr/local/nagios/libexec/check_nrpe -H $HOSTADDRESS$ -c $ARG1$

in windows.cfg:

define service{
use generic-service
host homeserver
service_description AD
check_command check_nrpe!actived

byBarosch, November 26, 2015
First of all...thank you for this nice script.
But I have a small problem.

Running the script from the cli works fine:
cscript //nologo .check_ad.vbs
OK - services: OK. replications: OK. advertising: OK. fsmocheck: OK. ridmanager: OK. machineaccount: OK.

But when i execute the script with "nscp test" the output is cropped
D ext-script Command line: cscript.exe //T:30 //NoLogo scripts\lib\wrapper.vbs check_ad.vbs
L cli OK: OK -

NSClient++ Version is

Can you help me with this problem?
Thank you in advance.
Hi, i have my domain controllers running on Windows Server 2012 in spanish versión, and not found, the check status is "unknown", somebody can help me please?

byBassDudu, April 17, 2014

I tried to figure out how to use the script in french version for Windows server 2012 but nothing works.

I changed the variables in french which are "réussi" when it's ok and "échoué" when it failed. But I'm not sure...
When I use dcdiag, all is ok and with the plugin all is critical.

Thank you
Owner's reply

Note that é may look the same on screen, but a string compare may fail due to different codepages.

Always validate script works when running from a command prompt before running via Nagios.

it doesn't work on windows 2008 r2 x64 domain controller because it require elevation.
it is a way to fix the code to make it work?
Owner's reply

Works fine for me when running under Nagios on Windows 2008, Windows 2008 R2, Windows 2012 and 2012 R2.

When testing running from a command prompt, yes, run with elevated rights.

byGuiona, March 1, 2014
doesn't work on French system with accented characters but I have solve this problem and add /help arguments.
You can found the code on https://github.com/Guiona/NagiosPlugins/blob/master/check_ad.vbs
byVitalyZ, January 14, 2014
Hi i'm having a hard time setting up check_ad on my nagios server returns an error on nagios return code of 127 is out of bounds - plugin may be missing in nagios i get a no handler for commmand. Please help.

This is what I've done so far
on the host:
In nsclient-full.ini I enabled external scripts allowed agruments and nasty characters
and added

[/settings/external scripts/scripts]
command[check_activedir]=cscript "C:\Program Files\NSClient++\scripts\Check_AD.vbs" //nologo /test:$ARG1$
also tried
[NRPE Handlers]
command[check_activedir]=cscript "C:\Program Files\NSClient++\scripts\Check_AD.vbs" //nologo /test:$ARG1$

on nagios server
in the commands.cfg added
define command{
command_name check_nrpe
command_line $users1$/checknrpe -H $HOSTNAME$ -c check_activedir -t TIMEOUT -a Replications }

in the machine settings file in nagios
define service {
use generic-service
hostgroup phx-dc
service_description active directory health
check_command Check_nrpe!check_activedir}


email me @ vitaly-23@yahoo.com (remove - between name and number) thank you
Script works fine most of the time but sometimes exits with error code -1073741819
Resulting in an unknown state for Nagios
Anyone got any suggestions for this ?

I don't seem to be the only person running in to this problem
Owner's reply

Check if error is caused by a specific test and add some more checks/debug information to see what causes the error (what line in the vbs file)


I have the same problem than Jeremy B, dcdiag result is on 2 line instead of 1 and I have a critical error for fsmo check.

how can I fix that ?

byleinad, April 3, 2013
...as it should!

Thanks a lot!
Works like a charm on Windows Server 2012
by, February 4, 2013
I use it to check an AD 2012 forest (W2008R2 and W2012 servers) and it works. But I needed to edit the script in order it works properly: "dcdiag.exe" output is not always on 1 line and the script doesn't handle it correctly.

Ex: dcdiag.exe /test:VerifyEnterpriseReferences
Will have these two lines for test result
......................... SRVXXX-XXX passed test
The script will find the "passed" word, but won't be able to associate it with the test name.

I solve it by using dcdiag output file and parse it instead of parsing directly the command output.
bythamildct, January 21, 2013
This script is working on my server with out any problem and it is gives the output.

Kindly help to configure the service description for this service on Nagios server?
bypablo.garciaa, December 1, 2011
If you have NSClient++ instead NRPE_NT, follow this instructions:
-Edit NSC.ini at nsclient folder.
-Below the line [NRPE Handlers] add this:
command[check_activedir]=cscript "C:Program FilesNagios
sclientscriptsCheck_AD.vbs" //nologo /test:$ARG1$

where "check_activedir" is the parameter that you pass from nagios with -c option, and "$ARG1$" are the services that you want check with -a option (separated by commas).

In Nagios, inside commands.cfg, you must put:
/usr/local/nagios/libexec/check_nrpe -H $HOSTNAME$ -c check_activedir -t TIMEOUT -a Replications,NetLogons,.....

Page 1 of 2