🟠 High   ⏱ 5–30 min  Last verified: 29 May 2026
Affected versions: Windows Server 2019

📖 ~1 min read

Table of contents
  1. Symptom & Impact
  2. Environment & Reproduction
  3. Root Cause Analysis
  4. Quick Triage
  5. Step-by-Step Diagnosis
  6. Solution — Primary Fix
  7. Solution — Alternative Approaches
  8. Verification & Acceptance Criteria
  9. Rollback Plan
  10. Prevention & Hardening
  11. Related Errors & Cross-Refs
  12. References & Further Reading

Symptom & Impact

Domain controllers stop replicating and changes like password resets or group updates do not converge across sites. Authentication drift and stale directory data can affect business services.

Environment & Reproduction

Observed on multi-DC Windows Server 2019 forests after DNS changes, firewall hardening, or WAN instability.

repadmin /replsummary
repadmin /showrepl
Get-ADDomainController -Filter * | Select HostName,Site

Root Cause Analysis

RPC endpoint mapper traffic, dynamic RPC ports, or DNS SRV resolution is blocked or inconsistent between DCs. Time skew can amplify Kerberos and replication failures.

Quick Triage

Validate DNS and RPC reachability between source and destination DCs before making topology changes.

Resolve-DnsName dc02.contoso.local
Test-NetConnection dc02.contoso.local -Port 135
w32tm /monitor

Step-by-Step Diagnosis

Collect replication status, Directory Service errors, and partner metadata to identify failing naming contexts.

repadmin /showrepl * /csv
dcdiag /test:replications /v
Get-WinEvent -LogName 'Directory Service' -MaxEvents 80
Illustrative mockup for windows-server-2019 — terminal_or_powershell
Replication diagnostics in PowerShell — Illustrative mockup — Progressive Robot

Solution — Primary Fix

Restore DNS and RPC connectivity, then force replication from healthy partners.

Still having issues? Our IT Solutions & Services team can diagnose and resolve this for you. Get in touch for a free consultation.

ipconfig /registerdns
Restart-Service Netlogon
repadmin /syncall /AdeP
repadmin /replsummary
Illustrative mockup for windows-server-2019 — event_or_log_viewer
Directory Service events for replication failures — Illustrative mockup — Progressive Robot

Solution — Alternative Approaches

If inter-site paths are constrained, tune site links and verify firewall rules for AD-specific traffic.

repadmin /kcc
Get-ADReplicationSiteLink -Filter * | Select Name,Cost,ReplicationFrequencyInMinutes

Verification & Acceptance Criteria

No recent replication failures and new AD object changes replicate across all domain controllers.

repadmin /replsummary
Get-ADReplicationFailure -Target * -Scope Forest

Rollback Plan

Revert recent DNS or firewall policy changes if replication degrades after remediation.

netsh advfirewall export C:Tempfw-after.wfw
# Import baseline policy backup if needed

Prevention & Hardening

Continuously monitor replication health and test DNS registration after each patch cycle.

repadmin /replsummary
dcdiag /q

Often appears with Event ID 1311, 1865, and Kerberos clock skew warnings in System and Directory Service logs.

Related tutorial: View the step-by-step tutorial for Windows Server 2019.

View all Windows Server 2019 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn: AD replication troubleshooting, RPC dependencies, and DNS best practices for domain controllers.

Need Expert Help?

If you cannot resolve this yourself, our team offers hands-on Server Management, Managed IT Services, and flexible Support Plans. Contact us today — we respond within one business day.