How to Set Up and Test Active Directory Replication Health

Replication problems between domain controllers are often silent for weeks before they cause a visible symptom. A password change that doesn’t propagate, a GPO that applies inconsistently, a user showing up in one site but not another. Checking replication health proactively with repadmin and dcdiag catches these before they become a support ticket.

Start with a replication summary

repadmin /replsummary gives a quick domain-wide view of the largest replication delay and failure count per DC. This is the first thing to run and the fastest way to spot a DC that’s silently fallen behind.

Dig into specific failures

For a DC showing failures, repadmin /showrepl DC01 lists every replication partner and the last successful/attempted sync with each, along with the specific error code on failure. Error 1722 (“RPC server unavailable”) usually points to a network/firewall issue between sites. Error 8524 relates to DNS resolution failures for the partner DC. Error 1256 (“The remote system is not available”) often means the target DC is simply offline or unreachable.

Run a full diagnostic pass

dcdiag /v /c /d /e /s:DC01 runs a comprehensive set of tests across every DC in the domain (the /e flag), covering DNS, replication, services, and more in one pass. It’s verbose, but scanning for “failed” in the output quickly surfaces which specific test and which DC needs attention.

Force replication when you need it immediately

After fixing an underlying issue, force replication rather than waiting for the normal interval:

repadmin /syncall /AdeP

Make checking replication health a routine, not just a reactive step. A scheduled weekly repadmin /replsummary export catches drift long before it becomes a genuine outage.

For official guidance, see Microsoft’s Windows Server documentation.