Configuring Active Directory Domain Services Replication in Server 2022

Posted on 21st June 2023

Introduction

Active Directory Domain Services (AD DS) is a critical part of any Windows Server deployment. It stores information about users, computers, and other resources on the network and provides centralized management and security for these objects. AD DS uses a multimaster replication model to maintain consistency between replicas of the directory database.

In a multimaster replication topology, any domain controller can accept and process updates to the directory. Changes that are made on one domain controller are replicated to other domain controllers in the domain. This allows for more flexibility and scalability than the single-master replication topology that was used in earlier versions of Active Directory.

However, the multimaster replication topology also introduces the possibility of replication conflicts, which can occur when two domain controllers attempt to update the same object concurrently. To help prevent replication conflicts, Active Directory uses a mechanism called conflict detection. When a domain controller detects a conflict, it resolves the conflict by choosing the most recent version of the object.

Replication Topology

AD DS uses a multimaster replication topology. In this type of replication topology, any domain controller can accept and process updates to the directory. Changes that are made on one domain controller are replicated to other domain controllers in the domain. This allows for more flexibility and scalability than the single-master replication topology that was used in earlier versions of Active Directory.

However, the multimaster replication topology also introduces the possibility of replication conflicts, which can occur when two domain controllers attempt to update the same object concurrently. To help prevent replication conflicts, Active Directory uses a mechanism called conflict detection. When a domain controller detects a conflict, it resolves the conflict by choosing the most recent version of the object.

Replication Schedule

By default, AD DS replication occurs automatically between domain controllers that have established a replication partnership. The replication schedule is the interval at which replication occurs between two partners. By default, replication occurs every five minutes.

In most cases, the default replication schedule is sufficient. However, you might want to change the replication schedule in the following situations:

• When you are troubleshooting replication problems
• When you are making changes to the directory that you want to replicated immediately

Changing the Replication Schedule

You can use the following procedure to change the replication schedule for all domain controllers in the forest.

1. Log on to a domain controller with an account that is a member of the Enterprise Admins group or the Domain Admins group.
2. Click Start, point to Administrative Tools, and then click Active Directory Sites and Services.
3. In the console tree, expand the Sites container, expand the site in which you want to change the replication schedule, and then expand the Servers container.
4. Click the domain controller on which you want to change the replication schedule.
5. In the details pane, right-click the NTDS Settings object, and then click Properties.
6. On the General tab, in Replication schedule, click Change.
7. In the Change Replication Schedule dialog box, click to select the replication interval that you want, and then click OK.

Conclusion

AD DS is a critical part of any Windows Server deployment. It stores information about users, computers, and other resources on the network and provides centralized management and security for these objects. AD DS uses a multimaster replication model to maintain consistency between replicas of the directory database.

In a multimaster replication topology, any domain controller can accept and process updates to the directory. Changes that are made on one domain controller are replicated to other domain controllers in the domain. This allows for more flexibility and scalability than the single-master replication topology that was used in earlier versions of Active Directory.

However, the multimaster replication topology also introduces the possibility of replication conflicts, which can occur when two domain controllers attempt to update the same object concurrently. To help prevent replication conflicts, Active Directory uses a mechanism called conflict detection. When a domain controller detects a conflict, it resolves the conflict by choosing the most recent version of the object.

You can use the following procedure to change the replication schedule for all domain controllers in the Forest.

1. Log on to a domain controller with an account that is a member of the Enterprise Admins group or the Domain Admins group.
2. Click Start, point to Administrative Tools, and then click Active Directory Sites and Services.
3. In the console tree, expand the Sites container, expand the site in which you want to change the replication schedule, and then expand the Servers container.
4. Click the domain controller on which you want to change the replication schedule.
5. In the details pane, right-click the NTDS Settings object, and then click Properties.
6. On the General tab, in Replication schedule, click Change.
7. In the Change Replication Schedule dialog box, click to select the replication interval that you want, and then click OK.

Configuring Active Directory Domain Services Replication in Server 2022

Introduction

In Server 2022, Active Directory Domain Services (AD DS) replication is the process by which changes that are made to Active Directory objects are copied from one domain controller to another.

Prerequisites

To configure AD DS replication in Server 2022, you must first have a working Active Directory forest that contains at least two domain controllers.

Configuring AD DS Replication

There are two ways to configure AD DS replication in Server 2022:

Option 1: Using the Active Directory Sites and Services snap-in

1. Log on to a domain controller with an account that is a member of the Domain Admins group.
2. Click Start, point to Administrative Tools, and then click Active Directory Sites and Services.
3. In the console tree, expand the Sites container, and then expand the site in which you want to configure replication.
4. Expand the Servers container, and then expand the server on which you want to configure replication.
5. Expand the NTDS Settings object for the server.
6. Right-click the NTDS Settings object, and then click Properties.
7. On the General tab, in the Replicate from drop-down list, click the domain controller from which you want the selected server to replicate.
8. Click OK.

Option 2: Using the Repadmin.exe command-line tool

1. Log on to a domain controller with an account that is a member of the Domain Admins group.
2. Click Start, and then click Run.
3. In the Open box, type cmd, and then click OK.
4. At the command prompt, type the following command, and then press Enter:

   repadmin /add "CN=NTDS Settings,CN=Server,CN=Sites,CN=Configuration,DC=domain,DC=com" "CN=NTDS Settings,CN=Server,CN=Sites,CN=Configuration,DC=domain,DC=com" /u:administrator /pw:password

5. At the command prompt, type the following command, and then press Enter:

   repadmin /replicate "CN=NTDS Settings,CN=Server,CN=Sites,CN=Configuration,DC=domain,DC=com" "CN=NTDS Settings,CN=Server,CN=Sites,CN=Configuration,DC=domain,DC=com" /u:administrator /pw:password

Verifying Replication

After you have configured AD DS replication, you can use the Repadmin.exe command-line tool to verify that replication is working correctly. To do this, follow these steps:

1. Log on to a domain controller with an account that is a member of the Domain Admins group.
2. Click Start, and then click Run.
3. In the Open box, type cmd, and then click OK.
4. At the command prompt, type the following command, and then press Enter:

   repadmin /showrepl

If replication is working correctly, you should see output similar to the following:


Replication Summary:

Number of replication failures: 0

Replication status for the following directory partitions:

DC=domain,DC=com

Domain controllers in domain DC=domain,DC=com:

SERVER1
NTDS Settings
Replicates To:
SERVER2

SERVER2
NTDS Settings
Replicates To:
SERVER1


If you see any replication errors, you can use the Repadmin.exe tool to troubleshoot them. For more information about using the Repadmin.exe tool, see the following Microsoft website:

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732887(v=ws.10)