So you have heard about a tool DFSDiag which is meant to be used to help you diagnose your DFS Namespace. You just type DFSDiag.exe and...
voilà you got the list of the commands you can use. Oh yes you also have the “DFSDIAG_ERROR” message, but that’s because DFSDiag expect one of the commands that it has implemented. Ok let me try to explain the options you have:
With this you can check the configuration of the domain controllers. It performs the following tests:
To run this command against your domain Contoso.com just type:
DFSDiag /testdcs /domain:Contoso.com
If you omit the parameter /Domain, the tests are run against the Domain the machine is joined to.
Used to check the configuration of Active Directory Domain Services (AD DS) sites by verifying that servers that act as namespace servers or folder (link) targets have the same site associations on all domain controllers.
So for a machine you will be running something like:
DFSDiag /testsites /machine:MyServer
For a folder (link):
DFSDiag /testsites /dfspath:\\Contoso.com\MyNamespace\MyLink /full
For a root:
DFSDiag /testsites /dfspath:\\Contoso.com\MyNamespace /recurse /full
But hey what’s the meaning of “recurse” and “full”? Don’t panic these are a couple of parameters that run a more comprehensive test. /recurse applies only to a namespace root path, where it enumerates and verifies the site associations for all folder targets. /full verifies that AD DS and the registry of the server contain the same site association information
With this you can check the DFS namespace configuration. The tests that perform are:
To run this you just need to type:
DFSDiag /testdfsconfig /dfsroot:\\Contoso.com\MyNamespace
Used to check the namespace integrity. The tests performed are:
To check the integrity of my namespace at contoso.com:
DFSDiag /testdfsintegrity /dfsroot:\\Contoso.com\MyNamespace
Additionally you can specify /full, /recurse, which in this case, /full verifies the consistency of share and NTFS ACLs in all the folder targets. It also verifies that the Online property is set in all the folder targets. /recurse performs the testing including the namespace interlinks.
Perform specific tests, depending on the type of referral being used.
Again for your namespace at contoso.com:
DFSDiag /testreferral /dfspath:\\Contoso.com\MyNamespace
There is also the option to use /full as an optional parameter, but this only applies to Domain and Root referrals. In these cases /full verifies the consistency of site association information between the registry and Active Directory.
A brief example of how DFSDiag can help you is to detect duplicate folders (links) in your deployment. For this you can use the command /testdfsintegrity with the /full flag and…
It will show you the “troublemaker” folders as in this case, where Link1 and Link2 are duplicated.
Ok these are the tests that DFSDiag performs; I hope this gives you a better understanding of what’s going on once you run the tool against your deployment!