Concept-first deep dive into how Active Directory replication actually works: multi-master design, USN and metadata tracking, naming-context partitions, intra-site vs inter-site frequency, the KCC topology generator, bridgehead servers, conflict resolution, lingering objects, and the repadmin replsummary diagnostic command.
10 articles • follow them in order
Active Directory replication is the engine that keeps every domain controller’s copy of the directory in agreement. It’s also where most “weird” AD problems live — lingering objects, USN rollback,…
Active Directory uses two replication models side-by-side. Multi-master replication is the default and covers 99% of directory data — users, groups, computers, OUs, ACLs. Single-master replication covers the five FSMO…
An AD object isn’t just a name and some attributes — it’s the attributes plus a per-attribute change diary. That diary, called replication metadata, is what makes inter-DC replication, conflict…
Active Directory replication is always pull-based, pairwise, and per naming context. Server A pulls from Server B for the Domain NC, then pulls again for the Configuration NC, then again…
AD replication runs on two clocks. Inside a site, it’s near-realtime — 15 seconds after any change. Across sites, it’s scheduled polling — default 180 minutes, minimum 15 minutes, configurable…
You never have to tell Active Directory “DC1 should replicate with DC2.” AD figures it out itself. The component that does the figuring is the Knowledge Consistency Checker (KCC) —…
If every DC in every site talked directly to every DC in every other site, an N-site forest with M DCs per site would have N×M×(N-1)×M long-distance connections — explosive…
Multi-master replication doesn’t prevent conflicts — it tolerates them. Two admins on two DCs can simultaneously edit the same attribute, create the same object, or move and delete things at…
A lingering object is a deleted AD object that didn’t get the “you’re deleted” memo before the memo itself expired. It sits on a long-disconnected DC, pretending to still be…
repadmin /replsummary is the single most useful command for telling you whether AD replication is healthy. One terminal, one keystroke, two columns of numbers that immediately surface every DC that’s…
