How to Troubleshoot Active Directory Replication: 10 Common Errors and Fixes
Active Directory replication keeps users, passwords, groups, computers, and Group Policy data synchronized between domain controllers. When replication breaks, the symptoms can include login failures, password changes that do not work, missing Group Policy updates, and inconsistent directory data.
repadmin /replsummary to identify failing domain controllers, then use repadmin /showrepl to read the exact error. Check DNS, RPC/network connectivity, time synchronization, AD services, and Event Viewer. Fix the root cause, run repadmin /syncall /AdeP, and confirm that replication errors are cleared.Table of Contents
- What You’ll Need
- How to Troubleshoot AD Replication
- Essential Commands
- Common Errors
- 10 Real-World Scenarios
- Best Practices
- Frequently Asked Questions
What You’ll Need
- Domain Administrator or delegated Active Directory permissions
- Administrator access to Command Prompt or PowerShell
- RSAT tools if you are running commands from a management server
- Network access to the affected domain controllers
- A recent System State backup before making high-risk directory changes
How to Troubleshoot Active Directory Replication
Step 1: Check overall replication health
repadmin /replsummaryReview Fails, % Error, and Largest Delta. A large delta may indicate a replication failure, an offline domain controller, or a retired server that was never cleaned up.
Step 2: Identify the source of the failure
repadmin /showreplRecord the destination domain controller, source replication partner, naming context, error code, and time of the last successful replication. The specific error code is the fastest route to the real cause.
Step 3: Verify DNS and connectivity
nslookup DC02.contoso.com
ping DC02.contoso.com
Test-NetConnection DC02.contoso.com -Port 135Domain controllers should use internal Active Directory-integrated DNS servers. Confirm that the hostname resolves to the correct internal IP address and that firewalls permit RPC connectivity.
Step 4: Check time, services, and logs
w32tm /query /status
sc query ntds
sc query netlogon
sc query dns
dcdiag /vConfirm that time is synchronized and that Active Directory Domain Services, Netlogon, DNS Server, and Kerberos services are running. Review the Directory Service, DNS Server, System, and DFS Replication Event Viewer logs.
Step 5: Force replication and validate the result
repadmin /syncall /AdeP
repadmin /replsummaryOnly force synchronization after addressing the cause. Confirm that failures are gone and that the largest replication delta returns to an expected range.
Essential Active Directory Replication Commands
| Command | Use |
|---|---|
repadmin /replsummary |
Summarizes replication health across domain controllers. |
repadmin /showrepl |
Shows replication partners, last attempts, and error codes. |
repadmin /syncall /AdeP |
Initiates replication across naming contexts. |
dcdiag /v |
Runs detailed domain controller diagnostics. |
dcdiag /test:dns /v |
Tests DNS configuration and health. |
Get-ADReplicationFailure -Target * |
Lists replication failures in PowerShell. |
Common Active Directory Replication Errors
- Error 1722 — RPC server unavailable: Usually DNS, firewall, network, RPC, or service related.
- Error 8453 — Replication access denied: Check authentication, permissions, machine accounts, and secure channels.
- Error 8524 — DNS lookup failure: Check A, CNAME, and SRV records, including the
_msdcszone. - Error 8614 — Tombstone lifetime exceeded: The domain controller may have been offline too long and often requires rebuilding.
- Error 1988 — Lingering objects: Use a documented recovery process; do not delete directory objects without a verified plan.
10 Common Active Directory Replication Troubleshooting Scenarios
1. New password does not work on another domain controller
Cause: The password change has not replicated. Fix: Check repadmin /replsummary, resolve failures, then run repadmin /syncall /AdeP.
2. Error 1722: The RPC server is unavailable
Cause: DNS, routing, firewall, or stopped service. Fix: Resolve the hostname, test port 135, and verify domain controller services.
3. One domain controller cannot resolve another DC’s hostname
Cause: Incorrect DNS configuration or stale records. Fix: Run nslookup, verify internal DNS settings, and check AD DNS records.
4. Group Policy changes are not reaching users
Cause: Active Directory or SYSVOL replication failure. Fix: Check repadmin /showrepl and DFS Replication event logs.
5. Branch-office DC has high replication delay
Cause: WAN issues, site-link scheduling, bandwidth limits, or wrong subnet mapping. Fix: Review Active Directory Sites and Services, site links, and WAN health.
6. Error 8453: Replication access was denied
Cause: Authentication, secure channel, or permission issue. Fix: Run dcdiag /v and investigate secure-channel and domain controller health errors.
7. A removed domain controller appears in reports
Cause: The server was not cleanly demoted. Fix: Verify it is permanently offline, then perform approved metadata cleanup and remove stale DNS records.
8. Error 8524: DNS lookup failure
Cause: Missing A, CNAME, or SRV records. Fix: Run dcdiag /test:dns /v, review the _msdcs zone, and re-register records if appropriate.
9. Replication fails after restoring a DC snapshot
Cause: Unsupported restore procedure or rollback risk. Fix: Stop, review Directory Service logs, and follow a supported AD recovery procedure.
10. Error 8614 or 1988: Tombstone lifetime or lingering objects
Cause: A domain controller has been offline too long. Fix: Treat this as high risk—confirm backups, assess rebuilding the DC, and use an approved lingering-object recovery process.
Pros and Cons of Active Directory Replication
Advantages
- Provides authentication and directory-service redundancy.
- Keeps passwords, users, groups, and policies synchronized.
- Supports branch-office users locally.
- Reduces dependence on one domain controller.
Limitations
- Relies on healthy DNS, time, authentication, and network services.
- Replication can be delayed in multi-site environments.
- Stale DCs and lingering objects require careful recovery work.
- Manual directory changes can increase risk when not documented.
Best Practices to Prevent Replication Failures
- Monitor health routinely with
repadmin /replsummary. - Use only trusted internal DNS servers on domain controllers.
- Maintain accurate domain time synchronization.
- Configure AD sites, subnets, and site links to match your network.
- Keep supported updates, tested backups, and recovery documentation.
- Demote domain controllers correctly before retirement.
- Add screenshots of your own tested command results to this article before publishing.
Frequently Asked Questions
How do I force Active Directory replication?
Run repadmin /syncall /AdeP from an elevated Command Prompt. First identify and address the underlying failure; forcing replication does not fix DNS, network, or authentication problems.
What is the best command to check AD replication?
repadmin /replsummary is the best starting point because it shows a concise health summary. Use repadmin /showrepl next to see detailed failures.
Why is Active Directory replication failing?
Frequent causes include incorrect DNS settings, RPC or firewall blocks, broken network paths, inaccurate time, stopped services, authentication issues, stale domain controllers, and lingering objects.
Can I delete a failing domain controller from Active Directory?
Do not delete it casually. If the server cannot be recovered and is permanently offline, use a documented metadata-cleanup procedure after confirming your backups and environment details.
Related Articles
- How to Run DCDiag and Fix Domain Controller Health Issues
- Active Directory DNS Best Practices for Domain Controllers
- How to Transfer FSMO Roles Safely
- How to Configure Active Directory Sites and Services
- How to Troubleshoot Group Policy Not Applying
Sources
- Microsoft: Troubleshoot Active Directory Replication Problems
- Microsoft: Repadmin Command Reference
- Microsoft: DCDiag Command Reference
repadmin /replsummary, use the precise error message to determine the cause, validate DNS and connectivity, and verify the repair with a second health check. For tombstone, lingering-object, or snapshot-related errors, follow a tested recovery process rather than applying quick fixes.
