AWS Managed MSAD Hybrid: Fix DcDiag Internal Exception Error

Select Language:

If you’re working with an AWS Managed Microsoft AD Hybrid setup and encounter a failed diagnostic test at the DC Diagnostic Test stage, you’re not alone. Here’s a straightforward way to understand and troubleshoot the issue.

First, the problem seems to originate during the execution of an SSM (AWS Systems Manager) command that runs a PowerShell script on your domain controllers. The command fails with an error message indicating an internal exception: “Cannot index into a null array.” This error happens on two different domain controllers during separate assessment attempts, which suggests a recurring issue rather than an isolated glitch.

Interestingly, despite this failure in the diagnostic test, your local checks show all is well: your dcdiag command passes without issues, replication is healthy, SYSVOL and NETLOGON shares are accessible, DNS records seem correct and consistent, and the necessary network connections are functioning properly. Also, the SSM agent is active, and communication appears intact.

Since your domain controllers are running localized versions of Windows Server in Korean, your question is whether AWS’s testDcDiag tool can handle non-English output from DCDiag. The good news is that most diagnostic tools are designed to work regardless of language, as long as they process the output correctly. Historically, a localized output can sometimes cause parsers or scripts to misinterpret the data, leading to errors like the one you’re seeing.

Given the error “Cannot index into a null array” and the fact that all local tests pass, it’s quite possible that the failure is caused by an issue within AWS’s testDcDiag script or parser that doesn’t properly handle non-English DCDiag output. This internal exception likely isn’t indicative of a real problem with your domain controllers but instead points to a compatibility issue.

To address this, consider the following steps:

Check if there’s an updated version of the AWS testing scripts that support localized outputs.
Run dcdiag manually in the Korean environment to verify if it provides expected results without errors.
Review AWS documentation or support channels to see if other users with localized environments have encountered similar issues.
As a workaround, you might try temporarily switching the language settings on your domain controllers to English during assessments, if feasible, to see if the test completes without errors.

Understanding that this error might stem from script or parser limitations rather than actual domain issues can save you time and prevent unnecessary troubleshooting. Rest assured, your core AD setup appears healthy based on the local diagnostics, and the issue is most likely with the assessment tool’s handling of localized output.