AD Replication :
To force Active Directory replication run the command 'repadmin /syncall /AeD'
Why is AD replication important?
Answer: Replication ensures that all Domain Controllers have the same data. This makes
sure that when something changes (like a password), it’s updated everywhere in the
network, so everyone can log in access resources correctly
[Link] command for AD replication status ?
repadmin /replsummary
Shows a summary of replication status between all domain controllers.
Helps you spot if any DCs are failing to replicate.
repadmin /showrepl : Shows detailed replication status per DC
repadmin /syncall - Forces manual replication between DCs
What are the types of AD replication?
1. Intra-site Replication
Happens within the same site (usually a fast LAN).
Fast and frequent.
Example: DC1 and DC2 are in the same office building — they replicate every few
seconds or minutes.
2. Inter-site Replication
Happens between different sites/locations (over WAN/Internet).
Slower and scheduled to save bandwidth.
Example: One DC in New York and another in London — they sync every hour or at
set times.
The default interval time for Active Directory replication between Domain Controllers
is:
Every 180 minutes (or 3 hours).
This means changes made on one Domain Controller will be replicated to other Domain
Controllers in the same domain after 3 hours by default.
How AD Replication Works Between Two Sites (In Simple Words)
You have two office locations (called sites) — like Office A and Office B.
Each office has its own Domain Controller (DC) that stores user info, passwords,
etc.
When something changes in Office A (like adding a new user), that change needs to
go to Office B too.
🔁 How It Happens:
1. A special connection (called a site link) is set up between the two offices.
2. One DC in each office is picked to handle the sharing of updates.
3. Changes are sent every 3 hours by default (you can change the timing).
4. Office B updates its data with the new changes.
What is bridgehead server ?
A bridgehead server is a domain controller within a site that acts as the primary server for
handling inbound and outbound replication for that site.
Purpose: Bridgehead servers help control replication traffic between sites.
Explain the flow of kerbaros ?
User asks for login.
User gets a TGT.
User asks for access to a service.
User gets a Service Ticket.
User gets access to the service.
Where can you find the AD data base ?
In Active Directory (AD), the database that stores all the AD data (such as user accounts,
groups, and other directory information) is called the [Link] file.
The Active Directory database ([Link]) is located in the C:\Windows\NTDS folder on a
Domain Controller.
Sysvol folder , how its replicated ?
The SYSVOL folder in a Windows domain holds important files like Group Policy settings and
logon scripts, which need to be shared between all domain controllers (DCs) in the network.
How SYSVOL is replicated:
1. Replication means copying the files from one domain controller's SYSVOL folder to
others, so they all have the same information.
What Are Lingering Objects in Active Directory?
Lingering objects are outdated items that don’t get deleted from all domain controllers
because of replication issues. They cause errors and inconsisdtency, but can be fixed by
checking replication and removing them with the right tools.
Active Directory (AD) Replication Errors – In Simple Words
❌ What are Replication Errors?
Replication errors happen when domain controllers can’t update each other properly.
This means:
One server might have a new user or setting,
But the other server doesn’t know about it.
🔍 Common Reasons:
1. Network problem – The servers can’t talk to each other.
2. DNS issue – The servers can’t find each other’s names.
3. Time mismatch – Server clocks are not in sync.
4. Wrong settings or permissions – A server doesn’t have access or is
misconfigured.
🛠️How to Check?
repadmin /replsummary
It will show if there are any errors in syncing between the servers.
✅ How to Fix (Simple Steps):
1. Check the network – Make sure the servers can connect (use ping).
2. Check DNS settings – Make sure they point to the right DNS server.
3. Sync time – Run this command:
4. w32tm /resync
[Link] replication – Run:
repadmin /syncall /AeD
🧠 Why It Matters?
If AD replication doesn’t work:
Some users might not be able to log in,
Group policies might not work,
Admin changes may not apply everywhere.
