Best Practice Analyser: 6 Proven Steps to Fix Your Server

Written by: Kymakers Support Team · Reviewed by: Kymakers Technical Team Last updated: July 2026 · Applies to: Windows Server 2016, 2019, 2022, 2025 Difficulty: Intermediate · Estimated time: 20–45 minutes

The Best Practice Analyser (BPA) is a free tool built into Windows Server that scans your installed roles and reports where your configuration deviates from Microsoft’s recommended practices. To run it, open Server Manager → Local Server → Best Practices Analyzer tile → Tasks → Start BPA Scan — results appear in a few minutes.

It’s one of the most useful server tools most administrators never open. This guide shows you how to run the Best Practice Analyser from both Server Manager and PowerShell, how to read the results, and how to decide which findings actually matter.

What BPA does and doesn’t do

The Best Practice Analyser measures your roles against Microsoft’s own rules across eight categories covering effectiveness, trustworthiness, and reliability. It does not fix anything automatically — it reports. And a violation isn’t always a real problem: some are deliberate choices for your environment. BPA gives you an informed list to review, not a to-do list to blindly follow.

Table of Contents

1. Step 1: Run a BPA scan from Server Manager
2. Step 2: Run BPA from PowerShell
3. Step 3: Understand the three result types
4. Step 4: Prioritise what to fix
5. Step 5: Export results for tracking
6. Step 6: Exclude findings you’ve reviewed
7. When to run BPA
8. FAQ

Step 1: Run a BPA Scan From Server Manager

The graphical route is the easiest way to start with the Best Practice Analyser.

1. Open Server Manager.
2. In the left navigation pane, select Local Server (or a specific role page like AD DS, DNS, or Hyper-V).
3. Scroll down to the Best Practices Analyzer tile.
4. Click the Tasks drop-down on the right of that tile.
5. Click Start BPA Scan.
6. Select the servers to scan and confirm.

Scanning the whole local server first gives you a baseline. Depending on how many rules apply, the scan takes a few minutes — and it keeps running even if you close Server Manager. Running the Best Practice Analyser from a role page scans all roles installed on servers in that group.

Step 2: Run BPA From PowerShell

For scripting, remote servers, or scanning several machines, PowerShell is faster than clicking through the GUI.

List the available models (these depend on which roles are installed):

Get-BpaModel

Run a scan using the model ID:

Invoke-BpaModel -ModelId Microsoft/Windows/DirectoryServices

View the results:

Get-BpaResult -ModelId Microsoft/Windows/DirectoryServices

Swap the model ID for the role you want — Microsoft/Windows/DNSServer for DNS, and so on. Running the Best Practice Analyser this way is quicker to repeat and easy to schedule, which is why most experienced admins prefer it.

Step 3: Understand the Three Result Types

Best Practice Analyser results come back in three severity levels, and knowing the difference stops you chasing non-issues:

• Error — the role doesn’t satisfy a best-practice rule and functionality problems can be expected. Investigate these first.
• Warning — the role is currently compliant enough to work, but noncompliance may cause problems if left unchanged. Review these next.
• Information — the role satisfies the rule. Nothing to do.

You may also see prerequisite results, which mean a rule couldn’t be applied at all, so it isn’t part of the scan outcome. Those aren’t failures — they’re rules that didn’t apply to your setup.

Step 4: Prioritise What to Fix

Here’s where judgement matters, and where the Best Practice Analyser is often misused: not every violation needs fixing.

Microsoft’s own guidance is clear that violations — even severe ones — aren’t necessarily problems. They indicate configurations that could result in poor performance, reliability issues, conflicts, or increased security risk. Some may be deliberate decisions in your environment.

A sensible order:

1. Errors on security-related rules — these usually deserve action.
2. Errors affecting reliability or availability — especially on domain controllers and production roles.
3. Warnings that match symptoms you’re already seeing — if BPA flags something and you have a matching complaint, that’s a strong signal.
4. Everything else — review, document your reasoning, and move on.

Read each finding’s description before changing anything. Blindly “fixing” every Best Practice Analyser result can break a working configuration.

Step 5: Export Results for Tracking

The console view is fine for a one-off look but poor for tracking changes over time. Export instead:

Get-BpaResult Microsoft/Windows/DirectoryServices | ConvertTo-Html | Set-Content C:\BPAResults\DirectoryServices.htm

This produces a readable HTML report you can save, compare against later scans, and share with your team. For regular audits, exporting each Best Practice Analyser run gives you a history — which is far more useful than a snapshot when you’re proving a server has been hardened over time.

Step 6: Exclude Findings You’ve Reviewed

Once you’ve reviewed a finding and decided it doesn’t apply to your environment, you can tell BPA to exclude it so it stops cluttering future scans.

In Server Manager, select the result and use the option to exclude it from results. In PowerShell, you can filter results as part of your reporting. The goal is a clean scan where anything showing up is genuinely new — that’s what makes the Best Practice Analyser useful as an ongoing check rather than a one-time curiosity.

Document why you excluded each item. Future you (or the next admin) will need that reasoning.

When to Run BPA

The Best Practice Analyser is most valuable at specific moments rather than constantly:

• After deploying a new server or role — catch misconfigurations before they reach production.
• After a major change — new role installed, significant configuration update, or migration.
• As part of a regular audit — quarterly is reasonable for most environments.
• When troubleshooting — if a role is behaving oddly, a BPA scan may point straight at the cause.

It’s a free tool that ships with Windows Server, so there’s no reason not to use it — the only cost is the time to review results properly.

FAQ About Best Practice Analyser

What is the Best Practice Analyser in Windows Server? It’s a built-in server management tool that scans installed roles against Microsoft’s best-practice rules and reports violations across eight categories of effectiveness, trustworthiness, and reliability. It reports issues but doesn’t fix them.

How do I run a BPA scan? Server Manager → Local Server → Best Practices Analyzer tile → Tasks → Start BPA Scan. Or in PowerShell: Invoke-BpaModel -ModelId <model>, then Get-BpaResult -ModelId <model>.

Do I need to fix every Best Practice Analyser warning? No. Microsoft notes that violations aren’t necessarily problems — some are deliberate choices for your environment. Prioritise security and reliability errors, review the rest, and document your decisions.

Which Windows Server versions include BPA? It’s available in Windows Server 2008 R2 onward, including 2016, 2019, 2022, and 2025. The roles you can scan depend on what’s installed.

Can I run BPA on multiple servers at once? Yes. Since Windows Server 2012, you can scan one or multiple roles across multiple servers, from either the Server Manager tile or PowerShell cmdlets.

Does BPA fix problems automatically? No. It’s a reporting tool. It identifies deviations from best practice and explains them, but every change is yours to make deliberately.

The Best Practice Analyser is free with Windows Server — but it only helps on a properly licensed, supported server. Kymakers supplies genuine Windows Server 2025 Standard and Windows Server 2022 licences with instant delivery and activation support. If you’re running an older version, our Server 2019 end of life guide covers the lifecycle picture, and Windows Server critical process died helps if a server is crashing.

Run a baseline scan, fix the errors that matter, document what you exclude — and re-scan after every major change.

Official reference: Run Best Practices Analyzer scans — Microsoft Learn