Archive: November, 2010

Checking AD Replication

2 comments November 29th, 2010

When you have multiple domain controllers they need to replicate since they are multi-masters. DC1 should hold the same data as DC2 and vice versa, and changes can be done on the DC that suits you (in theory).

If you want to have a quick look if the replication in your forest is ok, you can use a powerful command line tool called “repadmin”.

Open cmd and run: repadmin /replsum

If “largest delta” is less than 1 hour (intrasite) and “fails” = 0, your AD replication (not testing FRS replication) between all DCs in the forest is good.

If fails > 0 you need to investigate further.

Replication is based on pull, so you should focus on “Destination DSA” and “Inbound Neighbors”.

If DC01Test had some failures, I would run: “repadmin /showrepl dc01test” to see which DC(s) it can’t pull changes from, or if it’s a single Naming Context or all NC’s that it has problem replicating. Replication is 100% dependent of DNS, so DNS is a common cause of replication problems.


The five dots says I have 2 domain controllers in the forest. The first three dots are “processing dots”, while each of the rest represent a DC. 5 – 3 = 2 domain controllers.

Largest Delta: longest replication gap amongst all replication links for a particular DC

A. DC01Test Largest Delta: 47m:15s
B. Last attempt: 19:57:13 (from showrepl, where DC01test pulled schema changes from DC4test)

A + B = Rep. Summary Start Time: 20:44:28


Inbound Neighbors: Shows the DC’s <source DC> is pulling from and the 4 NC’s (5 links).

DSA Object GUID: The GUID of the source or destination. A CNAME named GUID located in the _msdcs domain zone must be present and have a value of the hostname of the correct DC.

Last attempt @: last time DC01Test pulled from DC4Test and if it was successful.

If you want to read more about what repadmin can do, you can download the whitepaper:

Traces of the old domain name after a rename

No comments November 7th, 2010

When you have renamed a domain there will be some registry keys left with the old domain name under HKLM\System\CCS\Services\NTDS\Parameters

Name: “Configuration NC”
Type: reg_sz
Value: CN=Configuration,DC=oldname,DC=com

Name: “Machine DN Name”
Type: reg_sz
Value: CN=NTDS Settings,……,CN=Configuration,DC=oldname,DC=com

Name: “Src Srv objectGuid”
Type: reg_binary
Value: <some_DC>

Those keys where created by LSASS.exe when the DC was created with DCPROMO. Rendom.exe will not modify them. They are not vital and are not in use. You can update those keys for consistency if you like.

Credit to Ned Pyle at AskDS for the information.