Gustavo,
Voce pode usar duas ferramentas muito boas para sua implantação e verificação de possíveis problemas. São elas;
Active Directory Best practices
Microsoft IT (Active Directory) Health Scanner
Uma das essenciais coisas são event viewer e algumas das ferramentas abaixo;
Dcdiag.exe /v >> c:\temp\pre_dcdiag.txt
This is a must and will always tell you if there is trouble with your DCs and/or services associated with it
Netdiag.exe /v >> c:\temp\pre_Netdiag.txt
This will let me know if there are issues with the networking components on the DC. This along with the post test also is a quick easy way to ensure the patch I just installed is really installed (just check the top of the log)
Netsh dhcp show server >> c:\temp\pre_dhcp.txt
Some may not do this but I've felt the pain of a DHCP server somehow not being authorized after a patch. This allows me verify the server count and names.
Repadmin /showreps >> c:\temp\pre_rep_partners.txt
This shows all my replication and if it was successful or not. Just be aware that Global Catalogs will have more info here than a normal domain controller.
repadmin /replsum /errorsonly >> c:\temp\pre_repadmin_err.txt
This is the one that always takes forever but will let you know who you are having issues replicating with.
Acho que estes recursos podem te ajudar a prevenir e cuidar melhor do seu AD.
Qualquer duvida post novamente.
Thiago Pereira | http://thiagoinfrat.spaces.live.com | www.winsec.org
