IT Toolbox
Guide

How to check Active Directory replication

Failure to perform Active Directory can cause inconsistent GPOs, different accounts depending on DCs or errors of authentication.

TopicActive Directory →
⌚ About 2 min read
View my favorites
Active Directory Advanced. 15 min.

Failure to perform Active Directory can cause inconsistent GPOs, different accounts depending on DCs or errors of authentication.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Identify controllers

    List the DCs and sites concerned.

  2. 2

    Get a summary

    Use repadmin /replucummary to detect mistaken partners.

  3. 3

    See details

    Run repadmin / showrepl on the DC concerned.

  4. 4

    Control DNS and time

    Validate resolution between DC and timing.

  5. 5

    Reviewing Events

    Consult the Directory Service, DFS Replication and System.

Commands utiles

repadmin /replucummary.
repadmin /showrepl.
dcdiag / test:dns /v.

À retenir

  • Do not force replication until the network cause or DNS is understood.
  • An old re-establishment of a DC, a good good old-fashioned one requires special attention.
  • Document errors by partner and the name of the partner.
← All les guides
Technical deep dive

AD replication: global health, partner and topology

Technical checkpoints

  • repadmin /replsummary gives a global view; repadmin /showrepl shows partner and last error per partition.
  • Sites/Subnets determine site placement and influence replication partners/costs.
  • DNS, time, RPC and secure channel can cause replication errors before AD itself is the root cause.

Replication view

Start with the summary then drill into only the failing DC/partition.

repadmin /replsummary
repadmin /showrepl * /errorsonly
dcdiag /test:replications

Topic-specific pitfalls

  • Forcing /syncall everywhere can multiply errors and does not fix a network/DNS root cause.
  • A missing AD subnet can send clients to a remote DC without an obvious replication error.

How to validate

  • All expected DCs replicate without recent errors and latency remains within the normal window.
  • Client subnets map to the correct site and DC discovery reflects that topology.
♡ 0