Replication between DCs has stopped or shows errors in repadmin.
Replication issues are usually DNS, name resolution, or a DC that was offline too long (lingering objects). Quick diagnostics with repadmin is the first step.
Try this first
- 1Run repadmin /replsummary on a DC. Note which partners fail and which error codes appear.
- 2DNS test: nslookup -type=A of each DC's hostname on the other DCs, plus the _msdcs SRV records. If that fails, fix DNS first.
- 3Network: ports 135 (RPC), 389 (LDAP), 445 (SMB), 88 (Kerberos) and the RPC range must be open between DCs.
- 4If a DC was offline longer than tombstone lifetime (60 or 180 days), do not bring it back online: it has lingering objects. Demote and rebuild with metadata cleanup.
- 5After fixing, force replication: repadmin /syncall /Aed, then run /replsummary again.
When to bring us in
Persistent USN rollback errors mean a DC was restored from a too-old backup. The proper fix is demote, metadata cleanup and re-promote. Don't muddle through.
See also
- One DC or two DCs for an SMB office?Two is almost always the right answer; one DC is a single point of failure for logon, DNS and GPOs.
- Should I split FSMO roles across two DCs?For a small domain all on one DC is fine; with two DCs splitting is tidier but not required.
- How do I know my AD replication is healthy?Replication errors creep in silently; they only surface when logins or GPOs misbehave.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.