How the domain was built, how the data was made and how the website works, with a full user guide
This guide explains how AD Report # 1 was made, from an empty Windows Server to the page in front of you, and how to get the most out of it.
The project has three parts, each in its own repository, and each passes its output to the next:
| Part | Repository | What It Does | Language |
|---|---|---|---|
| 1. Build | NewForest | Builds and hardens the adreps.com forest, then fills it with objects from a workbook | PowerShell |
| 2. Collect & enrich | datafromad | Reads everything about the forest into JSON, records DC performance, and adds synthetic data | PowerShell (+ a little C#) |
| 3. Report | ADReportsWebsite | This website: static pages that turn the JSON into tables, maps, charts and a live dashboard | HTML, CSS, JavaScript |
The forest is adreps.com (NetBIOS ADR), built on Windows Server 2025. It runs at the Windows Server 2025 forest and domain functional levels, with schema version 91. It has two real domain controllers in London, GBLON-DC01 and GBLON-DC02. Everything else in the directory was created by script from a workbook of fictitious but realistic data.
Three self-contained PowerShell scripts do the work, driven by two Excel workbooks. The scripts read .xlsx files directly (an .xlsx is a zip of XML), so they need neither Excel nor extra modules and work on Server Core.
| File | Purpose |
|---|---|
New-ADForest.ps1 | Builds the forest and applies the whole baseline in ordered phases. It also has maintenance modes for later, such as -SyncTierAccounts, -UpdateLocalAdmins, -EnforceT0Silo and -CreateObjects |
New-ADDC.ps1 | Promotes another server to a writable DC and Global Catalog, locally or remotely, with the same logging and reports |
New-ADForestDnsRecords.ps1 | Gives every fictitious computer a static DNS A and PTR record from its site's subnet |
config\New-ADForest-Config.xlsx | Settings: domain name, functional levels, paths, OU tree, password and LAPS policies, local admin extras. Checked before anything changes (-ValidateConfig) |
obdata\New-ADForest-ObData.xlsx | The objects to create: sites, subnets, site links, groups, admin accounts, users, workstations, laptops, PAWs, servers and group memberships |
PS C:\NewForest>
# Check the settings workbook - changes nothing
PS C:\NewForest>
.\New-ADForest.ps1
-ConfigFile
.\config\New-ADForest-Config.xlsx
-ValidateConfig
PS C:\NewForest>
# Build the forest, then create every object and the DC wallpaper at the end
PS C:\NewForest>
.\New-ADForest.ps1
-ConfigFile
.\config\New-ADForest-Config.xlsx
-CreateObjects
All
-Wallpaper
PS C:\NewForest>
# Later, on the next server: promote it to a DC
PS C:\NewForest>
.\New-ADDC.ps1
-ConfigFile
.\config\New-ADForest-Config.xlsx
-WallpaperPress play, or click a step, to follow the build from the two workbooks to a finished, hardened forest. The arrow keys step through it too.
The settings workbook holds the domain name, functional levels, OU tree and policies; the object data workbook holds the sites, subnets, users and computers. The script reads the .xlsx files directly, so it needs no Excel and runs on Server Core. -ValidateConfig checks them before anything changes.
Download this walkthrough as a video MP4 · 1080p · 69 seconds · 2.7 MB
The build runs as ordered phases and records its progress in C:\ProgramData\New-ADForest\state.json. After each reboot, a scheduled task resumes from where it stopped. Every step is safe to repeat, and -WhatIf is supported throughout. At the end it writes two HTML build reports (console and timeline) from the log.
| # | Phase | What It Does |
|---|---|---|
| 1 | Preflight | Elevated session, Server 2019 or later, not domain-joined, a proper hostname and a static IP |
| 2 | InstallFeatures | AD DS, DNS, Group Policy Management and the AD PowerShell module |
| 3 | PromoteForest | Install-ADDSForest with DNS, then a reboot |
| 4 | PostPromotion | Waits for AD, fixes the DC's DNS client if needed and sets its description |
| 5 | ADFeatures | AD Recycle Bin, and Database 32k pages when every DC runs Server 2025 |
| 6 | OUBaseline | The tiered OU structure. New users and computers are redirected to Staging |
| 7 | LAPS | Windows LAPS schema, per-tier reader groups, permissions and GPOs |
| 8 | BitLocker | BitLocker policy GPO and per-tier recovery key readers |
| 9 | GPOBaseline | ADMX Central Store, domain password policy, computer and server baselines, PDC time sync |
| 10 | SecurityBaseline | Settings modelled on Microsoft's Windows Server 2025 security baselines |
| 11 | AuditBaseline | 35 advanced audit subcategories, AD object auditing (including DCSync), LAPS and BitLocker read auditing, SYSVOL auditing and a 4 GB DC Security log |
| 12 | TierIsolation | Tier admin groups, deny-logon GPOs, Protected Users, an admin password policy and a Tier 0 authentication silo |
| 13 | TierDelegation | Role groups, local-admin GPOs (including PAW logon) and OU delegation |
| 14 | TierSyncTask | A gMSA and an hourly task that keeps the tier controls in step |
| 15 | DsrmSync | Every DC's DSRM password follows one disabled Tier 0 account |
| 16 | ObjectData | With -CreateObjects: the objects from the object data workbook |
| 17 | Wallpaper | With -Wallpaper: a desktop wallpaper showing each DC's health |
| 18 | Complete | Removes the resume task and writes the HTML build reports |
The forest follows Microsoft's tiered administration model. Tier 0 is the directory and anything that controls it (DCs, PKI, AD backup, Entra Connect, PAWs for Tier 0 admins). Tier 1 is servers and applications. Tier 2 is user workstations and the helpdesk. Accounts from one tier are blocked from logging on to the others.
DC=adreps,DC=com
├── Domain Controllers
├── Tier0 T0-Accounts · T0-Groups · T0-ServiceAccounts · T0-PAWS
│ T0-Servers: PKI, PAM, ADBackup, Entra, ADFS, SCOM, SCCM, App
├── Tier1 T1-Accounts · T1-Groups · T1-ServiceAccounts · T1-PAWS
│ T1-Servers: SQL, Web, File, Backup, SCCM, SCOM, App
├── Tier2 T2-Accounts · T2-Groups · T2-ServiceAccounts · T2-PAWS
├── ADR Users (Employees, Contractors, Shared)
│ Groups (Role, Resource, Distribution)
│ Workstations (Laptops, Desktops, Kiosks)
├── Staging new objects land here
└── Disabled deprovisioned, pending deletion-EnforceT0Silo.<OU>-Admins groups are local Administrators on the servers in their OU only. Group Policy Preferences enforce the exact membership.ADR-T*-PAW-Logon GPO.-SyncTierAccounts runs hourly under a gMSA. It flags any group with a direct member from another tier.| Area | What the Build Sets |
|---|---|
| Password policy | Domain: 14 characters minimum, complexity on, 24 remembered, lockout after 10 attempts for 15 minutes. Tier admins: 20 characters (PSO-TierAdmins) |
| LAPS | Windows LAPS on every tier. Passwords are 20 characters, encrypted in AD to that tier's reader group and changed every 30 days |
| BitLocker | XTS-AES 256 for OS and fixed drives. The recovery password must be backed up to AD before a drive can be encrypted. Per-tier recovery readers |
| Baseline (all) | SMBv1 off, SMB signing required, NTLMv2 only, AES-only Kerberos, LLMNR off, WDigest off, LDAP client signing, UAC, script block logging and the Windows Firewall |
| Baseline (DCs) | LDAP signing required, LDAP channel binding, Netlogon secure channel enforced (Zerologon), Print Spooler disabled, NTLM auditing |
| Auditing | 35 advanced audit subcategories, plus AD object auditing on the domain root, AdminSDHolder, GPOs and the tier OUs. Reads of LAPS and BitLocker secrets are audited |
| DSRM | A GPO-deployed task on every DC syncs the DSRM password from the disabled T0-DSRMSYNC account every hour |
| Time | The PDC emulator, targeted by a WMI filter so the role can move, syncs from pool.ntp.org |
The build creates or edits 23 GPOs, all named ADR-…. There are 14 baseline and tier GPOs, the 3 tier local-admin GPOs, ADR-DC-DSRMSync, 3 PAW logon GPOs, and the two default GPOs, which are edited. You can browse them on the Group Policy page. Each GPO's page shows its links and settings and the full Microsoft GPO report, with an explanation of every setting.
-CreateObjects All fills the forest from the object data workbook. The data is domain-neutral: {DOMAIN} and {NETBIOS} placeholders are filled in at run time. Every sheet is validated before anything is created, and re-runs skip objects that already exist.
| Sheet | Rows | What It Holds |
|---|---|---|
| Sites | 50 | Four regions, each with a hub: GBLON (EMEA), SGSIN (APAC), USWAS (North America) and BRSAO (LATAM) |
| SiteLinks | 10 | One link per region (cost 100, 15 minutes), plus a full mesh between the hubs (cost 150, 30 minutes) |
| Subnets | 250 | One /22 per site, split into Network /26, Core /26 (DCs), Servers /25, Devices /24 and Workstations /23 |
| Groups | 266 | AGDLP model: ROL-* role groups, RES-* resource groups, DL-* mail-enabled distribution lists |
| Accounts | 101 | Tier admin accounts for every role group, 4 domain admins and the DSRM sync account |
| Users | 570 | 500 employees, 50 contractors and 20 disabled shared accounts |
| Workstations / Laptops | 200 / 300 | One per employee at their site, e.g. GBLON-DT0001 |
| PAWs | 45 | 15 per tier at the hubs, each assigned to one role |
| Servers | 150 | 30 Tier 0 and 120 Tier 1 across the role OUs, e.g. GBLON-T1SQL01 |
| GroupMembers | 2,948 | One row per group membership |
The computers are fictitious and never join the domain. New-ADForestDnsRecords.ps1 then gives each one a static A and PTR record from its site's subnet, so they resolve like real machines.
From the lab forest to the files this website reads: the read-only collectors first, then the fictitious top-up described in Part 3.
Get-ADReportData.ps1 runs on a DC, or a machine with RSAT, as a Domain Admin. It only reads: forest, objects, sites, replication, DC diagnostics, DNS, Group Policy, security, tiers, LAPS, BitLocker, DSRM and inventory.
Download this walkthrough as a video MP4 · 1080p · 66 seconds · 2.2 MB
A read-only collector. It runs on a DC, or on a machine with RSAT, as a Domain Admin, and reads the forest through the AD, Group Policy, DNS and LAPS modules plus dcdiag, repadmin and CIM. It reads the other DCs over PowerShell remoting. It writes one Excel workbook and the same data as JSON, one file per data set, plus each GPO's report in XML and HTML.
PS C:\datafromad>
# Everything, from the PDC emulator
PS C:\datafromad>
.\Get-ADReportData.ps1
PS C:\datafromad>
# Some sections only, or quicker without the GPO reports and dcdiag
PS C:\datafromad>
.\Get-ADReportData.ps1
-Section
Objects,GPO,Security
PS C:\datafromad>
.\Get-ADReportData.ps1
-SkipGpoReports
-SkipDcDiag
PS C:\datafromad>
# What a run leaves behind (the lab collection used by this site)
PS C:\datafromad>
Get-ChildItem
.\output\ADR_20261012-1739
Directory: C:\datafromad\output\ADR_20261012-1739
Mode LastWriteTime Length Name
---- ------------- ------ ----
d---- 12/10/2026 17:44 GPOReports
d---- 12/10/2026 17:44 json
-a--- 12/10/2026 17:54 852858 ADReport_ADR_20261012-1739.xlsx
-a--- 12/10/2026 17:44 7111 Get-ADReportData.log
| Section | Data Sets |
|---|---|
| Forest | Forest, Domain, FSMORoles, Trusts, OptionalFeatures |
| Objects | Users, Computers, Groups, GroupMembers, ServiceAccounts, OUs, ObjectCounts, DeletedObjects |
| Sites | Sites, Subnets, SiteLinks, SiteLinkBridges, ReplConnections |
| Replication | ReplPartners, ReplSummary, ReplFailures, ReplQueue, ReplUpToDateness, RepadminShowRepl, ReplAttrMetadata, SysvolReplication |
| DC diagnostics | DomainControllers, DCHealth, DCServices, DCDiag, DCEvents, DCTasks, ADBackups |
| DNS | DnsZones, DnsServers, DnsDCRecords |
| Group Policy | GPOs, GPOLinks, GPOSettings, GPOPermissions, WmiFilters, ExpectedGPOs |
| Security | DCSecurityBaseline, DCAuditPolicy, PrivilegedGroups, Delegations, DCSyncRights, PasswordPolicies, KdsRootKeys, SecurityChecks |
| Tiers | TierModel, TierRoles, PAWGroups, CrossTierMembership, AuthPolicySilos |
| LAPS, BitLocker, DSRM | LapsStatus, LapsPermissions, BitLockerRecovery, BitLockerCoverage, DsrmStatus |
| Inventory | ComputerHardware, ComputerNICs, ComputerDisks, read live from each computer that answers |
Expected values, such as the build's GPOs and links, the DC registry baseline, the 35 audit subcategories and the DC services, are defined at the top of the script and mirror New-ADForest.ps1. A sheet that fails is marked Error on the Summary sheet, and the rest of the run carries on.
A second collector keeps a rolling 7-day history of CPU, memory, LSASS and network throughput for every DC, sampled every 5 minutes. It reads raw performance counters and compares them with the previous run, so each value is the true average over the 5 minutes, the same calculation Performance Monitor uses.
It's designed to run as two scheduled tasks under a gMSA on a Tier 0 management server: Collect every 5 minutes and Export hourly. It installs nothing on the DCs. The website charts the hourly figures, on the DC Performance page and in a Performance section on each DC page.
| Result | Warn | Fail |
|---|---|---|
| CPU | 95th percentile ≥ 70% | 95th percentile or last hour ≥ 90% |
| Memory used | 95th percentile ≥ 85% | Last hour ≥ 95% |
| Network (of link speed) | 95th percentile ≥ 70% or peak ≥ 90% | 95th percentile ≥ 90% |
| Coverage | Under 98% of slots | Under 90% of slots |
A two-DC lab can't show replication between continents, years of logon history or a fleet of servers. So the real collection was enriched to look like a mature global estate. Every row in every data set carries a DataSource value, so generated data can always be told apart from collected data.
In the data loaded now: 5,487 Live, 3,543 Enriched and 20,826 Synthetic rows. The Data Collection page breaks this down for every data set.
New-ADReportSyntheticData.ps1 reads a collection's JSON and writes a merged copy. It needs no AD access and never changes the original. It is deterministic: the same collection and the same seed (20261012) give identical output every time.
| Area | What Was Generated |
|---|---|
| Domain controllers | 2 per hub and 1 in every other site: 52 added, 54 in total. Hub DCs have at least 32 GB RAM and 8 cores. Each gets an IP from its site's Core subnet, plus health, services, dcdiag, events, baseline, audit policy, DNS, DSRM and hardware data, cloned from the real DCs and varied |
| FSMO roles | PDC emulator, RID master and infrastructure master on GBLON-DC02. Schema and domain naming master on GBLON-DC01 |
| Replication | A KCC-style topology: a ring within each site, each branch DC paired with one of its region's two hub DCs, and a full mesh between hubs. Partners, summaries, up-to-dateness vectors and repadmin /showrepl output to match |
| Computers | Vendor, model, serial, BIOS, CPU, RAM, disks, volumes and a network adapter for every computer, using the IP its DNS record already has. About 3% are left offline |
| Accounts | Created dates over a 6-year history, last logon, password age, and a few stale, never-used and locked-out accounts |
| LAPS & BitLocker | LAPS expiry per computer (a few missing or expired) and BitLocker recovery objects for workstations and PAWs (about 5% missing) |
| Other | Nightly AD backups, a forest trust to winreps.com, 14 recently deleted objects and 10 gMSAs |
| Recalculated | Site DC lists, the GC list, the tier model, LAPS and BitLocker coverage, the security checks and the overview figures |
New-ADPerfSyntheticData.ps1 then generates 7 days of 5-minute performance history for the same 54 DCs. Each DC follows a working day in its own local time: a logon peak from 08:00 to 09:30, a lunch dip, quiet nights, lighter weekends and a nightly backup at about 01:00. About 45% of DCs reboot on patch night.
A few problems were added on purpose, so every alert, badge and filter on the site has something real to show. They're listed in the data itself (SyntheticLog and PerfSyntheticLog):
| Where | Kind | Detail |
|---|---|---|
| ESMAD-DC01 | Replication | Inbound replication failing with 1722 The RPC server is unavailable. for 6.2 h |
| FRPAR-DC01 | Replication | Inbound replication failing with 8524 The DSA operation is unable to proceed because of a DNS lookup failure. for 0.8 h |
| CATOR-DC01 | Health & security | Print Spooler running on a DC |
| PLWAR-DC01 | Health & security | LDAP channel binding off |
| CLSAN-DC01 | Health & security | DSRM password sync failed |
| USWAS-DC02 | Health & security | Low disk space |
| CHBER-DC01 | Health & security | Clock skew |
| SGSIN-DC01 | Performance: High CPU | LSASS at 85-98% CPU for the last 30 hours - expensive unindexed LDAP queries from an application server. Fails on CPU last hour. |
| ITROM-DC01 | Performance: Memory leak | Memory in use climbs all week to about 97% (LSASS private bytes - third-party password filter). Fails on memory last hour. |
| CNSHA-DC01 | Performance: WAN outage | Site link down for 8 hours - DC unreachable from the collector. Warns on coverage. |
| IEDUB-DC01 | Performance: NIC at 100 Mbps | Adapter negotiated 100 Mbps instead of 1 Gbps - saturates during the nightly backup and runs hot in business hours. Warns on network utilisation. |
| T0-MGMT01 | Performance: Collector missed runs | Management server restarted for patching - 3 collection runs missed for every DC. Shows as missed collection slots on the Overview sheet. |
The collectors run on a schedule and Update-SiteData.ps1 drops their JSON files into site\data: one file per data set, plus a manifest with the collection time.
Download this walkthrough as a video MP4 · 1080p · 58 seconds · 1.5 MB
To see it for real, the recorded tour opens the Ops Dashboard and a report page, uses a table's filters and search, follows a DC link, then swaps in a new DCHealth.json and presses Refresh data:
Download the website tour MP4 · 1080p · 86 seconds · 8.5 MB
The site is a folder of static files with no build step, no framework and no server code. Each page is a small HTML file that loads a shared stylesheet and script, plus the script for that page. When a page opens it fetches the JSON data sets it needs from the shared site/data/adreps/ folder (named by a <meta name="adr-data"> line in each page, so every report on the site reads the same files), always bypassing the browser cache, and builds the tables, maps and charts in the browser. Replacing a JSON file updates every page that uses it on the next refresh.
browser ── GET overview.html ──▶ page shell (menu, header, footer)
── GET ../data/adreps/*.json ─▶ tables · tiles · maps · charts
Cloudflare Workers: /data/* is always revalidated (site/_headers)| Technology | Used for |
|---|---|
| HTML5 | One small file per page. Content is built by script from the data |
| CSS3 | Every colour, shadow and size is a custom property, so light and dark themes swap in one place. Layout uses grid and flexbox, and colours are mixed with color-mix() |
| JavaScript (ES2020+) | Plain browser JavaScript with no framework. Shared code is in core.js, table-driven pages are configured in views.js, and designed pages have their own script |
| SVG | World maps, site and replication maps, donut, bar and line charts, heatmaps, the DC topology diagram and icons |
| Canvas 2D | The spinning globe on the Ops Dashboard, an orthographic projection drawn every frame |
| JSON | All report data, produced by the PowerShell collectors |
| PowerShell | Everything upstream: the forest build, the collectors, the synthetic data, and the site tools Update-SiteData.ps1 and Start-LocalSite.ps1 |
| Node.js | tools/Build-WorldMap.mjs, run once, pre-projects the country borders into assets/geo/world.json |
| Data & fonts | Country borders from Natural Earth (via world-atlas), flags from flag-icons (MIT), and the Manrope and JetBrains Mono fonts from Google Fonts |
| Hosting | Cloudflare Workers (static assets), serving the site folder as is |
ADReportsWebsite/
├── site/ ← published folder
│ ├── index.html, home/ the report gallery (activedirectoryreports.com)
│ ├── _headers Cloudflare: always revalidate /data/*
│ ├── data/adreps/ adreps.com, the collection every report reads (+ Perf*.json, GPOReports/*.html)
│ ├── shared/ country flags and map data every report uses (flags/, geo/)
│ ├── adr2/ AD Report # 2: the same pages in the console style
│ └── adr1/ AD Report # 1 (this report)
│ ├── *.html one per page; index.html is the Ops Dashboard
│ └── assets/
│ ├── css/site.css design tokens, themes and components
│ ├── css/noc.css Ops Dashboard layout
│ ├── js/core.js data loader, menu, page shell, tables, search, pop-ups, full screen
│ ├── js/views.js configuration for the table-driven pages
│ ├── js/map.js shared world map (sites, replication)
│ ├── js/globe.js the dashboard globe
│ ├── js/perf.js performance charts and heatmap
│ ├── js/pages/*.js designed pages (dashboard, DC, site, policy…)
└── tools/ Update-SiteData.ps1, Start-LocalSite.ps1, Build-WorldMap.mjsADR.page() draws the menu, header, breadcrumb and footer, then calls the page's own render function. Refresh data re-runs it without reloading the page.ADR.table() handles search, filter buttons, sorting, page size, expandable rows, CSV export, and automatic links to DCs, sites, users, groups, computers, GPOs, OUs and subnets.views.js: which files to load, the tiles to show, and each table's columns and filters.PS H:\My Drive\repos\ADReportsWebsite>
# Load a collection into site\data - the newest synthetic run under ..\datafromad\output
PS H:\My Drive\repos\ADReportsWebsite>
.\tools\Update-SiteData.ps1
-PreferSynthetic
PS H:\My Drive\repos\ADReportsWebsite>
# ...or a particular run, and the DC performance history
PS H:\My Drive\repos\ADReportsWebsite>
.\tools\Update-SiteData.ps1
-RunPath
'H:\My Drive\repos\datafromad\output\ADR_20261012-1739'
PS H:\My Drive\repos\ADReportsWebsite>
.\tools\Update-SiteData.ps1
-Perf
PS H:\My Drive\repos\ADReportsWebsite>
# Preview locally on http://localhost:8080 (browsers won't load JSON from file://)
PS H:\My Drive\repos\ADReportsWebsite>
.\tools\Start-LocalSite.ps1
PS H:\My Drive\repos\ADReportsWebsite>
# Deploy: a Git-connected Cloudflare Worker builds every push (wrangler.jsonc names the site folder), or deploy directly
PS H:\My Drive\repos\ADReportsWebsite>
npx
wrangler
deployUpdate-SiteData.ps1 checks that every file is valid JSON before replacing anything, and converts the GPO reports to UTF-8. Of the performance files it copies only the six the site uses. The raw 5-minute samples are larger than the 25 MiB file limit of Cloudflare Workers.
A short recorded tour of the Policy & Security pages: Group Policy and a GPO report, Security Checks, Privileged Access & Tiers, LAPS & DSRM, and BitLocker.
Download the Policy & Security tour MP4 · 1080p · 112 seconds · 9.0 MB
| Menu | Page | Shows |
|---|---|---|
| Directory | Ops Dashboard | Wall-screen view: spinning globe, health and compliance panels, every DC at a glance |
| Overview | The headline numbers for the whole forest, with links into each area | |
| Forest & Domain | Functional levels, schema, FSMO roles, optional features, trusts and domain settings | |
| Sites & Geography | Map of every site by region, site links, subnets and site coverage | |
| Infrastructure | Domain Controllers | Every DC with health, OS, roles and hardware; replication failures |
| Replication | Replication map, partners, failures, queue, connections and SYSVOL | |
| DC Diagnostics | dcdiag results, services, event-log errors and warnings, scheduled tasks | |
| DC Performance | A week of CPU, memory and network for every DC, by region and hour | |
| DNS | Zones, DNS server settings and DC locator records | |
| Objects | Users | Every account with tier, type, logon and password state |
| Computers | Workstations, laptops, PAWs, servers and DCs with OS, LAPS and BitLocker | |
| Groups | Every group with scope, type, tier, owner and membership | |
| Organizational Units | The OU tree with tier, protection, GPO links and object counts | |
| Policy & Security | Group Policy | Every GPO, its links, settings, permissions and the expected build GPOs |
| Security Checks | Domain-wide security checks, DC baseline drift and audit policy | |
| Privileged Access & Tiers | Privileged groups, the tier model, role groups, PAWs, silos and delegations | |
| LAPS & DSRM | LAPS coverage and readers, and the DSRM password sync on each DC | |
| BitLocker | BitLocker recovery key coverage by type and tier | |
| Report | Data Collection | Every data set with its rows, status and Live / Enriched / Synthetic mix |
| About | About & FAQs | What this report is, and FAQs |
| Guide | This guide |
| Control | What It Does |
|---|---|
| Search box | Filters the table as you type. Several words must all match, in any column |
| Filter buttons | Narrow the table to one kind of row. The number is how many rows match. Red buttons pick out failures or errors, and amber buttons pick out warnings. Many buttons explain what they match when you hover over them |
| Column headings | Click to sort, and click again to reverse |
| Default · Rows ▾ · All | Beside the page numbers: return to the normal page size, choose a size, or show every row on one page |
| › at the start of a row | Appears when a row has cut-off text. Click to see the whole row, or use the heading's button to expand every row on the page |
| CSV | Downloads the rows you're looking at, after search and filters |
| Links | Names of DCs, sites, users, groups, computers, GPOs, OUs and subnets open their own page. Hovering shows a summary card |
The Ops Dashboard is the home page. It's built for a wall screen in an operations centre: a spinning globe of every DC and replication link, health and compliance panels on either side, and a wall of every DC along the bottom.
| Control | What It Does |
|---|---|
| Spin II · 1× · 2× · 3× | Pause the globe or set its speed (remembered) |
| Reset | Returns the globe to its starting size, position and speed |
| Drag / mouse wheel | Turn the globe by hand, or zoom |
| Region buttons | Turn the globe to a region |
| Region colours | Tint countries by region, or switch the tint off |
| Hover a DC | On the globe or the DC wall: its status, site, roles, uptime, CPU, memory, replication and dcdiag results |
| Click a DC | Opens that DC's page |
| +N more | A panel has more items than fit. Click to open the full page |
| F | Full screen on or off |
The dashboard reloads its data every 5 minutes, with a countdown under the globe. Each panel is graded OK, Warning or Alert, and the overall status at the top is the worst of them.
Press Full screen at the top of any page. The site stays full screen as you move between pages. A Back button appears at the top left that steps back through the pages you've visited, without ever leaving the site. Press Esc or Exit full screen to leave. If you refresh while in full screen, the browser drops out of it, and the next click or key press puts it back.
Press / from anywhere, or click the search box. Suggestions appear as you type, across DCs, countries, sites, subnets, users, groups, computers, GPOs, OUs, event IDs and report pages. Computers can be found by IP address. Press Enter for the full results page, with a filter button for each type.
| Key | Where | Action |
|---|---|---|
| / | Any page | Jump to the search box |
| Enter | Search box | Open the full search results |
| F | Ops Dashboard | Full screen on or off |
| Esc | Anywhere | Leave full screen or close a pop-up |
| Alt + ← | Anywhere | Back (also in full screen) |
| ← → | Performance charts | Step through the hours |
| Problem | What to Do |
|---|---|
| The page still shows old data | Press Refresh data, or Ctrl + F5 to reload the page and its scripts as well |
| A page says a file could not be loaded | That data set isn't in data/. Re-run Update-SiteData.ps1, or for the performance pages, Update-SiteData.ps1 -Perf |
| Nothing loads when opening the HTML file directly | Browsers block JSON from file://. Use Start-LocalSite.ps1 or a web server |
| "Click anywhere to return to full screen" | The page was reloaded while in full screen. Click or press a key to go back to full screen, or press × to stay in a window |
| Fonts look different | The web fonts couldn't be reached (for example offline), so the system font is used instead. Nothing else is affected |
Still stuck? See the FAQs.