How do I resolve replication issues between multiple Active Directory domain controllers?

1. Identify the Issue

Determine the scope and specifics of the replication problem first.

Check Event Viewer for replication-related errors or warnings (Event IDs 1864, 2103, 1084).
Run the Active Directory Replication Status Tool (ADREPLSTATUS) — Microsoft’s free diagnostic utility.
Use repadmin /replsummary for a quick replication health summary across all DCs.

2. Verify Network Connectivity

Replication needs stable network connectivity between domain controllers.

Ping the affected DCs to confirm reachability.
Check DNS resolution for DC names with nslookup <dc-name>.
Confirm required ports are open between DCs: 135 (RPC), 445 (SMB), 389 (LDAP), 636 (LDAPS), plus 53 (DNS), 88 (Kerberos), 123 (NTP), and 3268/3269 (Global Catalog) if applicable.

3. Check Time Synchronization

Kerberos authentication requires synchronized clocks; time drift breaks replication.

Run w32tm /query /status on each DC to verify time configuration.
Ensure the forest-root PDC Emulator syncs with an external time source and all other DCs sync with the PDC Emulator.

4. Verify DNS Configuration

Active Directory relies on DNS for replication.

Confirm each DC points to itself for DNS (primary) and other DCs as secondary.
Run dcdiag /test:dns to validate DNS health.
Verify SRV records (e.g., _ldap._tcp) exist for the affected DCs.

5. Use Repadmin for Diagnostics

Repadmin is the primary command-line tool for AD replication troubleshooting.

repadmin /showrepl — displays replication status for all DCs.
repadmin /showconn — shows connection objects between DCs.
repadmin /syncall — forces synchronization across all DCs (use cautiously; generates heavy traffic).
repadmin /queue — lists pending replication requests.

6. Check the AD Database (NTDS)

AD database corruption can also cause replication failures.

Run dcdiag /test:replications to check replication health.
Examine NTDS logs in Event Viewer for database errors.
If corruption is suspected, restore from backup or use ntdsutil for database repair operations (semantic analysis, authoritative restore).

7. Resolve Stale or Lingering Objects

Lingering objects appear when a DC is offline longer than the tombstone lifetime (default 180 days).

Clean them with repadmin /removelingeringobjects <target-dc> <source-dc> <naming-context> — specify source and target DCs.
Confirm tombstone lifetime is set appropriately for your environment.

8. Check AD Site and Replication Topology

Site or replication topology misconfigurations also cause problems.

Use Active Directory Sites and Services to verify site links, subnets, and replication schedules.
Run repadmin /kcc to force the Knowledge Consistency Checker (KCC) to rebuild the replication topology.

9. Verify Security Permissions

Misconfigured permissions can block replication.

Ensure the Domain Controllers group holds necessary replication permissions (e.g., Replicate Directory Changes on relevant partitions).
Check for Group Policy settings that might block replication traffic (firewall rules, IPsec policies).

10. Restart AD Services

Restarting AD services can clear transient issues.

Restart the Active Directory Domain Services service on affected DCs.
If SYSVOL replication is stuck, restart the DFS Replication service (DFSR). FRS is deprecated and removed in Server 2019.

11. Monitor and Test Replication

Verify replication works after changes.

Trigger manual replication with repadmin /syncall.
Confirm health with dcdiag /test:replications.

12. Escalate or Restore from Backup

If the issue persists, escalate to Microsoft support or restore the affected DC from a known-good backup.