Active Directory Replication Failure

Run repadmin and dcdiag from both Windows Server 2019 domain controllers to identify the failing directory partition, last-success timestamp, and hidden status code before forcing replication or changing AD objects.

1. Capture replication status

Open Command Prompt as administrator on DC1 and run:

mkdir C:\Temp 2>nul
repadmin /replsummary > C:\Temp\DC1-replsummary.txt
repadmin /showrepl DC1 /all /verbose > C:\Temp\DC1-showrepl.txt
repadmin /showrepl DC3 /all /verbose > C:\Temp\DC3-showrepl.txt
repadmin /showrepl * /csv > C:\Temp\showrepl.csv
dcdiag /test:Replications /v > C:\Temp\DC1-replications.txt

Repeat dcdiag /test:Replications /v locally on DC3, writing to a DC3-specific file. Alternatively, display the forest-wide report interactively:

repadmin /showrepl * /csv |
    ConvertFrom-Csv |
    Out-GridView

Inspect these fields for every naming context:

• Last Success Time
• Last Failure Time
• Last Failure Status
• Source and destination DC
• Consecutive failure count
• Missing Inbound Neighbors

repadmin /showrepl is the primary supported method for exposing replication errors that may not appear in a graphical operation. AD replication depends on networking, DNS, authentication, time accuracy, the directory database, topology, and the replication engine.^1^

Do not delete objects, edit the registry, demote a DC, or repeatedly run repadmin /syncall until the actual status and affected naming context are known.

2. Check Directory Service events on both DCs

On both servers, open:

Event Viewer → Applications and Services Logs → Directory Service

Review Error and Warning events covering the period since the last successful replication. Record:

• Event ID
• Error/status code
• Source and destination DC
• Naming context
• Object DN, if present

Also inspect System and DNS Server logs. Microsoft’s guidance treats Directory Service events and repadmin /showrepl output as the principal sources for identifying the constraint causing replication failure.^2^

3. Test DNS independently in both directions

Run the following from an elevated prompt:

dcdiag /test:DNS /v /s:DC1 /f:C:\Temp\DC1-DNS.txt
dcdiag /test:DNS /v /s:DC3 /f:C:\Temp\DC3-DNS.txt
dcdiag /test:DNS /DnsRecordRegistration /v /e /f:C:\Temp\DNS-records.txt
nslookup DC1
nslookup DC3

Expected results:

• Both DC names resolve to the correct IP addresses.
• DNS client servers configured on each DC are reachable.
• DNS Client, Netlogon, KDC, and DNS Server services pass.
• Host A, GUID-based CNAME, LDAP SRV, GC SRV, and PDC SRV registrations pass.

The DNS test validates connectivity, essential services, DNS client configuration, zones, and DC locator records used by replication.^3^

4. Test connectivity and RPC in both directions

From DC1:

Resolve-DnsName DC3
Test-NetConnection DC3 -Port 53
Test-NetConnection DC3 -Port 88
Test-NetConnection DC3 -Port 135
Test-NetConnection DC3 -Port 389
Test-NetConnection DC3 -Port 445

Repeat from DC3, targeting DC1. A successful fixed-port test does not prove that dynamic RPC is available. AD replication contacts the RPC Endpoint Mapper on TCP 135 and then uses a dynamically assigned RPC port; Windows Server 2019 environments require the high TCP range 49152–65535 to be permitted where a firewall separates the DCs.^4^

Check Windows Defender Firewall, network firewalls, VPN rules, and VLAN access control lists in both directions. Do not restrict AD replication to one static RPC port unless that is an intentional firewall design; other AD dependencies still require additional ports.^5^

5. Apply the branch matching the discovered status

• 1722: investigate DNS, TCP 135, dynamic RPC, routing, or firewall filtering.^6^
• 8524, Event 2087, or 2088: correct DNS client configuration or missing/incorrect A, SRV, or GUID CNAME records.
• 8453 or “access denied”: run dcdiag /test:NCSecDesc and dcdiag /test:MachineAccount; investigate permissions and the DC computer account rather than networking.^7^
• 2042, 1988, or lingering-object indications: stop before forcing replication and assess tombstone-lifetime/divergence conditions.
• No inbound neighbors: inspect Active Directory Sites and Services → Sites → site → Servers → DC → NTDS Settings for topology and connection-object issues.

After correcting the identified fault, initiate one controlled replication in Active Directory Sites and Services by right-clicking the appropriate connection under NTDS Settings and selecting Replicate Now. Then rerun repadmin /replsummary and confirm zero failures plus a current Last Success Time in both directions.

References

1. Diagnose Active Directory replication failures
2. Troubleshooting Active Directory Replication Problems
3. Active Directory replication Event ID 2087: DNS lookup failure caused replication to fail
4. Service overview and network port requirements for Windows
5. How to restrict Active Directory RPC traffic to a specific port
6. Active Directory replication error 1722: The RPC server is unavailable
7. Active Directory replication error 8453: Replication access was denied