Investigate Active Directory replication failures before forcing synchronization

Detailed practical guide

Prepare your workspace and inputs

Get the incident time, expected domain controller names, sites and replication schedule. Replace DC01 with an approved domain controller. Do not run a forced synchronization during evidence collection.

Platform context: Windows Server administration workstation with AD DS tools and delegated permission to inspect the target domain controllers. Commands are diagnostic only.

Scenario to reproduce or investigate

A user sees an old group membership on one site. A replication summary can locate a problem but does not show every failing naming context or justify a blanket syncall.

1. Capture source and destination summary with the same observation time

   Run both directions and record the exact output. Distinguish the number of failing replication links from the largest elapsed time. Expected intersite schedules affect interpretation, so a large delta alone needs comparison with the configured schedule.

   Command, configuration or input

   repadmin /replsummary /bysrc /bydest /sort:delta

   Expected result · ผลที่ควรเห็น

   The report identifies which source or destination DC rows have failures and preserves the exact error code and largest delta.

   If it fails · เมื่อไม่ผ่าน

   If a DC is unreachable to the reporting workstation, record that collection failure separately from a confirmed DC-to-DC replication failure.

2. Inspect the affected inbound partner and naming context

   Choose the destination DC from the summary and inspect its inbound replication partners. Record the failing source, naming context, last success and last attempt. Keep the timestamp and error together; a historic error followed by success needs different treatment from a continuing failure.

   Command, configuration or input

   repadmin /showrepl DC01 /all /verbose

   Expected result · ผลที่ควรเห็น

   You can identify an exact source → destination → naming-context relationship and its most recent result.

   If it fails · เมื่อไม่ผ่าน

   If the summary and detailed output differ, repeat with a recorded time and check whether recovery occurred between observations. Do not combine unrelated partitions into a single cause.

3. Choose the next evidence check from the actual error

   For a name-resolution symptom, check the reported source DC’s expected DNS records using the intended internal resolver. For authentication or RPC symptoms, preserve the code and follow the matching Microsoft diagnostic rather than resetting accounts or opening broad firewall access. Recheck the same /showrepl relationship after an approved correction and compare the last-success time.

   Command, configuration or input

   Record: destination DC | source DC | naming context | last success | current error | next diagnostic | owner

   Expected result · ผลที่ควรเห็น

   The next action targets the observed failure class and closure evidence shows a fresh successful replication for the affected relationship.

   If it fails · เมื่อไม่ผ่าน

   If the error suggests lingering objects, USN rollback or an unsupported restore, stop routine retries and use the corresponding recovery procedure with the directory owner; do not force synchronization blindly.

Recovery and cleanup

The commands make no directory changes. Any later DNS, firewall or account correction must preserve its previous settings and follow the directory owner’s recovery process; no destructive directory repair is included here.

Apply to actual work and known limits

Use supported AD administration tools for the deployed server release. The command-reference page includes older product applicability; verify installed-tool syntax and use the exact-error documentation for your current environment.

Authored against the cited documentation. Execution on the stated vendor product or physical equipment remains to be verified.