Using checkADConfig to detect connectivity and DNS issues between vCenter Server and Active Directory
book
Article ID: 344880
calendar_today
Updated On:
Products
VMware vCenter Server
Issue/Introduction
This article shows how to use the checkADConfig.sh script. This script is meant to collect data regarding connectivity/port connectivity to all the Domain Controllers within the specified domain based on krb5-affinity.conf file and lookups of SRV records for the specified domain with the functionality to check site specific SRV records. It can also be used to query a specified DNS server to get the response for lookups of Domain Controllers.
Symptoms: Slow or failed authentication with Active Directory credentials.
Resolution
Using the checkADConfig.sh script
This tool should be run from a PSC or embedded vCenter Server.
Download the checkADConfig.sh script attached to this article.
From an SSH session to the vCenter Appliance, create a new directory for the tool
mkdir -p /root/debugging cd /root/debugging
Move the checkADConfig.sh file to the /root/debugging directory
Make the file executable
chmod +x /root/debugging/checkADConfig.sh
Run the script with the options applicable for your environment
It will generate output into a file like this: checkADConfig_res.txt An example of this file has also been attached to this article for comparison.
Additional Information
For information on using the lw_measure tool to detect latency between vCenter Server and Active Directory domain controllers, see https://kb.vmware.com/s/article/79317