Skip to main content

Check Active Directory replication health with repadmin

Symptoms​

  • Password or group changes appear on some domain controllers but not others.
  • Event Viewer shows replication errors in the Directory Service log.
  • You want to confirm replication is healthy before or after a DC change.

Resolution​

Run these commands from an elevated Command Prompt or PowerShell window on a domain controller, using an account with the required rights.

1. Get a summary of replication​

repadmin /replsummary

Look at the fails and largest delta columns. Anything other than 0 failures needs investigation.

2. See per-partner detail​

repadmin /showrepl

This lists each inbound replication partner and shows the last attempt and result for every naming context.

3. Force replication to all partners​

repadmin /syncall /AdeP

The switches tell repadmin to sync all partitions (A), push to all partners (d shows distinguished names, e crosses site boundaries, P pushes changes).

4. Run the built-in replication test​

dcdiag /test:replications

Verify​

Run repadmin /replsummary again. All DCs should show 0 failures and a small largest delta.

note

If a command returns Access is denied, see Fix repadmin "Access is denied" (error 5).