Interactive Troubleshooter

Published: Sep 1, 2026

Updated: Sep 1, 2026

Active Directory Replication Failed: Diagnostic Steps

Time: 15 mins Level: Beginner

By StepDiag Engineering Team

Reviewed by Ibraheem Taofeeq Opeyemi

An interactive root-cause diagnostic tree to systematically isolate and resolve Active Directory domain controller replication failures across Windows Server environments. Identify RPC port blocks, DNS _msdcs locator record failures, Kerberos time skew desynchronization, and Tombstone Lifetime lingering objects.

Full Diagnostic Tree & Step-by-Step Overview

What specific Active Directory replication error code or behavior is repadmin reporting?

RPC error 1722 / 1753 ('The RPC server is unavailable' or 'No more endpoints available')
DNS / Time error 8524 / 8456 / 8457 ('The DSA operation is unable to proceed' or DNS lookup failure)
Authentication / Tombstone error 8606 / 8614 / 5 ('Tombstone Lifetime exceeded' or 'Access Denied')

How is the RPC transport or connectivity failure presenting between Domain Controllers?

Error 1722: Network transport blocked on Port 135 or dynamic RPC port range (49152-65535)
Error 1753 / 1908: RPC Endpoint Mapper unreachable or Target Principal Name (SPN) mismatch

Unblock RPC Dynamic Ports, Reset RPCSS Service, and Audit Network Firewalls

Solution:

Root Cause: Blocked RPC Endpoint Mapper (Port 135) or Dynamic High Ports (49152-65535)

Active Directory replication relies on the Remote Procedure Call (RPC) Endpoint Mapper listening on TCP Port 135 to negotiate dynamic high ports (TCP 49152–65535 in Windows Server 2008 R2 and later). If an internal firewall, IPsec policy, or third-party endpoint security suite blocks Port 135 or the dynamic RPC range, repadmin /showrepl throws Error 1722.

# Step-by-Step Fix:

Verify RPC Network Connectivity via PowerShell:

Run the following network diagnostic commands from the source DC to the target DC:

powershell
   Test-NetConnection -ComputerName DC02.domain.com -Port 135

Test access to the dynamic RPC range using PortQry or PowerShell:

powershell
   Test-NetConnection -ComputerName DC02.domain.com -Port 49152

Configure Windows Defender Firewall Rules:

On both Domain Controllers, ensure the built-in inbound firewall rules are enabled:

Active Directory Domain Controller - RPC (TCP-In)

Active Directory Domain Controller - RPC Endpoint Mapper (TCP-In)

Run this PowerShell command to enable mandatory AD replication rules:

powershell
   Enable-NetFirewallRule -DisplayGroup "Active Directory Domain Controller"

Restart RPC and Active Directory Domain Services (NTDS):

Verify that the RpcSs (Remote Procedure Call) and NTDS services are running.

Execute command to force KCC (Knowledge Consistency Checker) topology recalculation:

cmd
   repadmin /kcc

Force Immediate Partition Sync:

cmd
   repadmin /syncall /A /e /P

Repair Missing Service Principal Names (SPN) and Fix RPC Endpoint Mapper Registration

Solution:

Root Cause: Missing or Duplicate Service Principal Name (SPN) Registration

RPC Error 1753 / 1908 ('Target Principal Name Incorrect') occurs when the destination Domain Controller attempts to authenticate the replication request via Kerberos, but the source DC lacks the required E33866E3-50E0-409E-A416-820986345C51 (NTDS Replication GUID) SPN registered in Active Directory.

# Step-by-Step Fix:

Inspect Registered SPNs on the Source DC:

Run setspn to query registered replication SPNs for the affected DC:

cmd
   setspn -L SourceDCName

Verify the presence of E33866E3-50E0-409E-A416-820986345C51/DSA_GUID/domain.com.

Identify and Resolve Duplicate SPNs:

Query the directory for duplicate SPN entries causing authentication collisions:

cmd
   setspn -X

If duplicate SPNs are discovered, unbind the erroneous account using setspn -D.

Force SPN and DNS Host Record Re-registration:

Open Command Prompt as Administrator on the failing DC and run:

cmd
   ipconfig /registerdns
   net stop ntds
   net start ntds

Verify Endpoint Mapper Registration via PortQry:

Run PortQry against TCP Port 135 to ensure AD interfaces are registered in the RPC database:

cmd
   portqry -n SourceDCName -e 135

What underlying infrastructure protocol (DNS or Time Sync) is breaking replication?

Error 8524: DNS lookup failure / Missing _msdcs CNAME GUID record for Domain Controller
Error 8456 / 8457: Time desynchronization / Kerberos clock skew exceeds 5 minutes threshold

Rebuild Missing _msdcs CNAME Records and Flush DNS Resolver Cache

Solution:

Root Cause: Missing _msdcs CNAME Alias Record or DNS Infrastructure Failure

Active Directory replication requires each Domain Controller to resolve its peer's DSA GUID CNAME record inside the _msdcs.ForestRootDomain DNS zone. Error 8524 indicates that the destination DC cannot resolve the source DC's unique GUID CNAME record to an IP address.

# Step-by-Step Fix:

Locate the Missing CNAME GUID Record:

Obtain the target DC's ObjectGUID by running:

cmd
   repadmin /showrepl DestinationDC

Perform a DNS lookup for the specific CNAME record:

cmd
   nslookup -type=CNAME <DSA_GUID>._msdcs.yourdomain.com

Force Registration of AD Locator DNS Records:

On the source DC, restart the Netlogon service to force record generation:

cmd
   net stop netlogon && net start netlogon
   ipconfig /flushdns
   ipconfig /registerdns

Manually Recreate CNAME Record in DNS Manager (If Automatic Registration Fails):

Open dnsmgmt.msc > expand _msdcs.yourdomain.com > CNAME (Alias).

Add a new Alias: Name = <DSA_GUID>, Fully Qualified Domain Name = SourceDC.yourdomain.com.

Verify DNS Health across all DCs:

Execute full DNS diagnostics using dcdiag:

cmd
   dcdiag /test:dns /dnsall /v

Synchronize W32Time Clock Hierarchy to Fix Kerberos Skew

Solution:

Root Cause: Kerberos Time Skew Exceeding 5-Minute Maximum Tolerance

Kerberos v5 authentication protocols reject ticket granting requests if time desynchronization between Domain Controllers exceeds 300 seconds (5 minutes). When clock skew occurs, AD replication halts with errors 8456 or 8457.

# Step-by-Step Fix:

Audit Time Differences Across Domain Controllers:

Run w32tm to monitor time offsets across your domain:

cmd
   w32tm /monitor /domain:yourdomain.com

Configure PDC Emulator as Primary NTP Time Source:

On the PDC Emulator FSMO role holder, set external authoritative NTP servers (e.g., pool.ntp.org):

cmd
   w32tm /config /manualpeerlist:"0.pool.ntp.org,0x8 1.pool.ntp.org,0x8" /syncfromflags:manual /reliable:YES /update

Re-configure Non-PDC Domain Controllers to Sync from Domain Hierarchy:

On all non-PDC Domain Controllers, reset time synchronization back to domain hierarchy:

cmd
   w32tm /config /syncfromflags:domhier /update
   net stop w32time && net start w32time
   w32tm /resync /rediscover

Disable Hypervisor Time Synchronization (Virtual DCs):

If running DCs as Virtual Machines (Hyper-V/VMware), disable Time Synchronization integration services under VM settings to prevent the hypervisor host from overriding domain time.

Is the authentication or object replication failing due to legacy state or stale databases?

Error 8606 / 8614: Lingering objects exist or DC hasn't replicated within Tombstone Lifetime (TSL)
Error 5: Access Denied / Broken secure channel computer account trust relationship

Remove Lingering Objects and Re-enable Strict Replication Consistency

Solution:

Root Cause: Exceeded Tombstone Lifetime (TSL) and Lingering Database Objects

If a Domain Controller remains disconnected longer than the Tombstone Lifetime (typically 180 days), deleted objects purged on healthy DCs will persist on the disconnected DC. When reconnected, 'Strict Replication Consistency' blocks replication (Error 8606/8614) to prevent re-introducing deleted 'lingering objects' into the forest.

# Step-by-Step Fix:

Identify Lingering Objects with repadmin:

Run a advisory scan to identify lingering objects on the destination DC:

cmd
   repadmin /removelingeringobjects DestinationDC SourceDC_GUID DirectoryPartition /advisory_mode

Purge Lingering Objects:

Execute the purge command without advisory mode:

cmd
   repadmin /removelingeringobjects DestinationDC SourceDC_GUID DirectoryPartition

Enable Strict Replication Consistency across Forest:

Ensure strict replication protection is turned on to prevent future lingering object propagation:

cmd
   repadmin /regkey * +strict

Demote and Re-promote DC (If Disconnected Past TSL):

If the DC has been offline past Tombstone Lifetime and lingering object cleanup fails, forcefully demote the DC, clean up metadata via ntdsutil, and re-promote it:

cmd
   dcdiag /test:knowsofroleholders

Reset Domain Controller Machine Account Password and Repair Secure Channel

Solution:

Root Cause: Broken Secure Channel or Machine Account Password Desynchronization

Domain Controllers automatically update their machine account passwords every 30 days. If replication is interrupted during a password change window, the machine password stored in the local LSA secret desynchronizes from the copy stored on peer DCs, causing Error 5 ('Access Denied').

# Step-by-Step Fix:

Test Secure Channel Status:

Run nltest on the failing DC to verify trust relationship status:

cmd
   nltest /sc_query:yourdomain.com

Reset DC Secure Channel Password via KPASSWD:

Stop the KDC service on the problem DC to prevent local ticket issuance during reset:

cmd
   net stop kdc

Execute netdom to reset the machine account password against a healthy peer DC:

cmd
   netdom resetpwd /server:HealthyDC.yourdomain.com /userd:yourdomain\DomainAdmin /passwordd:*

Restart KDC and Active Directory Services:

Restart services and flush Kerberos ticket cache:

cmd
   net start kdc
   klist purge

Force Immediate Replication Sync:

Initiate manual replication sync:

cmd
   repadmin /syncall /A /e /d /P

Related Diagnostic Guides

Google Account Suspicious Activity? How to Check for Unknown Devices

Microsoft Account Hacked? How to Recover and Secure Your Account

Fast Charging Not Working? How to Check USB PD and Quick Charge Support

Laptop Using Integrated Graphics Instead of Dedicated GPU? Here's How to Fix It

Google Family Link Not Blocking Apps? Here's How to Fix It

Subscribe to StepDiag

Embed Guide on Your Website