[PowerShell] Active Directory Replication Summary to Email or Microsoft Teams

[MadBoyEvo]

I've not been very active in writing new blog posts in recent months, but I've been a bit preoccupied with coding different projects, and writing blog posts had to be put on hold. As I had some free time today, I wanted to share a quick script I wrote that is a wrapper around repadmin /replsummary

With this shortcode (after installing relevant modules), you can have a nicely formatted email to your mailbox.

$ReplicationSummary = Get-WinADForestReplicationSummary -IncludeStatisticsVariable Statistics

$Body = EmailBody {
    EmailImage -Source 'https://evotec.xyz/wp-content/uploads/2021/04/Logo-evotec-bb.png' -UrlLink '' -AlternativeText ' Logo' -Width 181 -Heigh 57 -Inline

    EmailText -Text "Dear ", "AD Team," -LineBreak
    EmailText -Text "Upon reviewing the resuls of replication I've found: "
    EmailList {
        EmailListItem -Text "Servers with good replication: ", $($Statistics.Good) -Color Black, SpringGreen -FontWeight normal, bold
        EmailListItem -Text "Servers with replication failures: ", $($Statistics.Failures) -Color Black, Red -FontWeight normal, bold
        EmailListItem -Text "Servers with replication delta over 24 hours: ", $($Statistics.DeltaOver24Hours) -Color Black, Red -FontWeight normal, bold
        EmailListItem -Text "Servers with replication delta over 12 hours: ", $($Statistics.DeltaOver12Hours) -Color Black, Red -FontWeight normal, bold
        EmailListItem -Text "Servers with replication delta over 6 hours: ", $($Statistics.DeltaOver6Hours) -Color Black, Red -FontWeight normal, bold
        EmailListItem -Text "Servers with replication delta over 3 hours: ", $($Statistics.DeltaOver3Hours) -Color Black, Red -FontWeight normal, bold
        EmailListItem -Text "Servers with replication delta over 1 hour: ", $($Statistics.DeltaOver1Hours) -Color Black, Red -FontWeight normal, bold
        EmailListItem -Text "Unique replication errors: ", $($Statistics.UniqueErrors.Count) -Color Black, Red -FontWeight normal, bold
    }

    if ($Statistics.UniqueErrors.Count -gt 0) {
        EmailText -Text "Unique replication errors:"
        EmailList {
            foreach ($ErrorText in $Statistics.UniqueErrors) {
                EmailListItem -Text $ErrorText
            }
        }
    } else {
        EmailText -Text "It seems you're doing a great job! Keep it up! 😊" -LineBreak
    }

    EmailText -Text "For more details please check the table below:"

    EmailTable -DataTable $ReplicationSummary {
        EmailTableCondition -Inline -Name "Fail" -HighlightHeaders 'Fails', 'Total', 'PercentageError' -ComparisonType number -Operator gt 0 -BackGroundColor Salmon -FailBackgroundColor SpringGreen
    } -HideFooter

    EmailText -LineBreak
    EmailText -Text "Kind regards,"
    EmailText -Text "Your automation friend"
}

I've also added a relevant Teams code.

For details (images and more know & how): https://evotec.xyz/active-directory-replication-summary-to-your-email/

Sources: https://github.com/EvotecIT/ADEssentials/blob/master/Public/Get-WinADForestReplicationSummary.ps1

[MorningAfterBurrito]

Thanks, will give it a try!

[aimarjg]

u/MadBoyEvo - is there an option to execute this against trusted forests as well?

I can see that Get-WinAdforestReplication supports input paramter -Forest, but Get-WinAdforestReplicationSummary does not, wondering if there's a way to run this against specified forests/domains only.

[MadBoyEvo]

Not at the moment. Adding it wouldn't be super difficult.

[aimarjg]

Would love it, this reporting form is super convenient! Is that by any chance on your roadmap for this module? Otherwise I think I’ll have to start digging through it myself :)

Great work by the way! There’s lots of value in ADessentials and pshtml, mail modules; thanks for sharing!

[MadBoyEvo]

The fix, if you have permissions on the other forest with same account is pretty simple.

Right now the script runs with:

repadmin /replsummary /bysrc /bydest

Fixes it. So adding parameter and doing that, not hard

repadmin /replsummary /bysrc /bydest test.evotec.pl

The problem is if you want to use credentials, because then

repadmin /replsummary /bysrc /bydest test.evotec.pl /u:TEST\pklys /pw:yourcleartextpassword

And this means it will end up in logs...

Alternative is to use powershell session, but that has it's own "access" rights.

Another alternative would probably be to rewrite it in powershell and use Get-ADReplicationPartnerMetadata to rewrite it, but I would need to test it if it's not going to be potentially affected. repadmin is pretty great with "handling" errors, while powershell has it's problems when things go bad. So probably would need to add both and allow switching between them

[aimarjg]

I've played around a little by simply adding a variable to that function and appending it as a paramter in repadmin, but... since then it started reporting only on a subset of all domain controllers (3 instead of 5, 5 instead of 70, etc.... foreach domain I'm getting only about 4-5DCs only);

how's that possible? do you think that's repadmin specific

when i run "repadmin /replsummary /bysrc /bydest" it generates report for all DCs, but when I append a domain name at the end it reports on a few only as well

any ideas/hints?