KBY Technologies Logo
runbooks/identity-access-management/active-directory-domain-controller-replication-failure.md
CRITICAL SEVERITYIdentity & Access ManagementActive Directory

Active Directory Domain Controller Replication Failure

Severity
CRITICAL
Target Time
40 minutes to isolate the failing replication edge
DomainIdentity & Access Management
Verified
Overview

Diagnose Active Directory domain controller replication failure with Repadmin, DCDiag, event IDs, DNS, RPC and time evidence; avoid forest-wide repadmin /syncall until topology knowledge is consistent and the exact error is resolved.

Share

01 // Diagnose

Symptom

Incident signalWhat responders observe

Repadmin or Directory Service events show repeated inbound or outbound replication failures, topology incomplete, stale last-success times or inconsistent directory data between domain controllers. Authentication, Group Policy, password changes, group membership, DNS-integrated zones and other directory-dependent services can return different results depending on the DC contacted.

Detection Signature

Detection evidenceMetrics, logs, and confirmation commands

  1. Record the first failure time, source DC, destination DC, naming context, numeric error and relevant Directory Service event IDs.

  2. Run Repadmin forest summary and showrepl output, then isolate the failing directed edge rather than treating every DC as equally faulty.

  3. Run the DCDiag Replications test and inspect Directory Service, DNS Server, DFS Replication and System logs around the failure.

  4. Verify DNS name resolution, RPC/network reachability, authentication, permissions and time accuracy before manipulating topology.

  5. Compare the affected DCs' connection objects and topology knowledge. For error 8452 or topology-incomplete evidence, do not run repadmin /syncall until partners agree on source DCs and naming contexts.

Root Cause Analysis

Causal chainWhy the incident occurred

  1. DNS registration or name resolution pointed a replication partner to the wrong or unreachable address.

  2. RPC, firewall, routing or site connectivity blocked the replication edge.

  3. Kerberos authentication failed because of time skew, machine-account, secure-channel or permission problems.

  4. KCC topology or connection-object changes had not converged, producing error 8452 when replication was initiated from stale topology knowledge.

  5. A DC was intentionally offline, demoted incorrectly, restored unsafely or retained beyond tombstone lifetime.

  6. Directory database, schema or lingering-object conditions require an error-specific recovery rather than a generic forced synchronisation.

02 // Contain & Prevent

Blast Radius

  • Passwords, accounts, groups, Group Policy and DNS-integrated data can differ across domain controllers.

  • Authentication and authorisation outcomes can vary by site or client referral.

  • A broad forced sync against inconsistent topology can generate error 8452 and obscure the original failing edge.

  • Unsafe restore or lingering-object actions can spread directory inconsistency forest-wide.

Prevention Measures

Prevent recurrenceControls and architectural guardrails

  • Monitor Repadmin failure count and last-success age per directed replication edge, not only forest totals.

  • Alert on Directory Service replication and DNS registration errors with site and DC ownership.

  • Keep DC time hierarchy, DNS client settings, site links and firewall rules documented and tested.

  • Use supported backup/restore and demotion procedures.

  • Track offline DCs against tombstone lifetime.

  • Review AD replication latency and tombstones and the Kerberos clock-skew runbook during prevention work.

03 // Fix & Intervention

Pre-Flight Checks

Change gateChecks required before intervention

  1. Confirm at least one healthy writable DC and a current supported system-state backup for the affected domain.

  2. Capture Repadmin, DCDiag, event logs, DNS records, time status and current connection objects.

  3. Identify whether the DC is intentionally offline, in maintenance, being demoted or beyond tombstone lifetime.

  4. Freeze broad repadmin /syncall, KCC forcing, metadata cleanup, lingering-object removal and restore actions.

  5. Obtain the AD service owner change approval before DNS, firewall, time, secure-channel or topology modification.

Execution CommandsCOMMANDS

# Run from an elevated Windows shell; all commands below are diagnostic.
repadmin /replsummary
repadmin /showrepl * /csv
repadmin /queue *
dcdiag /test:replications /v
w32tm /monitor
Resolve-DnsName -Name ("_ldap._tcp.dc._msdcs.{0}" -f $env:USERDNSDOMAIN) -Type SRV

04 // Verify & Recover

Verification Steps

Recovery proofEvidence required before closure

  1. Re-run Repadmin and confirm zero failures on the repaired directed edge across at least three consecutive scheduled replication cycles.

  2. Verify the last-success timestamp advances for each affected naming context and replication queues return to baseline.

  3. Confirm DCDiag Replications passes on source and destination DCs.

  4. Create a harmless test object through the approved test OU and verify convergence from another site, then remove it through normal replicated administration.

  5. Monitor Directory Service, DNS and DFS Replication logs for at least 60 consecutive minutes before closure.

Rollback Protocol

Safe reversal path

  1. Revert only the approved DNS, firewall, time or connection-object change using the captured pre-change state.

  2. If replication health worsens, stop further topology manipulation and preserve all logs.

  3. Restore a domain controller only through the supported AD recovery plan and current system-state backup

  4. do not improvise rollback with forced sync, snapshot reversion or metadata cleanup.

Escalation

Conditions requiring additional ownership

  • No healthy writable DC or current supported backup can be confirmed.

  • The DC is beyond tombstone lifetime, shows lingering objects, database errors, schema mismatch or suspected USN rollback.

  • Error 8452 persists after topology convergence, or the required source/naming-context relationship remains unclear.

  • The repair would require metadata cleanup, lingering-object removal, authoritative restore or forest recovery.

  • Escalate to the AD forest owner and Microsoft Support with Repadmin CSV, DCDiag output, event logs and topology evidence.

Authoritative Sources

Authoritative · Microsoft

Troubleshooting Active Directory replication problems

Defines the systematic DNS, network, security, topology and replication-engine investigation path.

Authoritative · Microsoft

Diagnose Active Directory replication failures

Verifies Repadmin showrepl use and the core replication dependencies.

Authoritative · Microsoft

Active Directory replication error 8452

Documents topology-incomplete behaviour and explicitly cautions against repadmin /syncall until topology knowledge agrees.

Related Runbooks

high45m

Entra B2B ReadResponseFailure: Disposed HttpWebResponse

Diagnose Entra B2B invitation failures showing ReadResponseFailure, Cannot access a disposed object, or System.Net.HttpWebResponse by correlating request IDs, invited identity and partner-scoped policy evidence.

Active Directory Domain Controller Replication Failure - Incident Runbook | KBY Technologies