Chad DuffeySecurity engineer

Active Directory Replication and topology

Measure replication convergence

Time a directory change and a SYSVOL file separately, keep failed queries in the results, and distinguish arrival time from last-success age.

Choose the question and replica set

Convergence is the time a change takes to reach the replicas that need it. replsummary largest delta is the age of a relationship’s last successful replication. An idle schema NC can have an older success than a busy domain NC while both work correctly. Recent successes elsewhere also don’t tell you whether a particular object reached its destination. See replication status and the Repadmin summary definition.

Define the origin, NC, attribute, expected replicas, timing limit and acceptable result before testing. A domain-OU object tests that domain’s replicas. A Configuration object tests a different replica set. A GC comparison requires an attribute in its partial attribute set; an RODC comparison requires data it is permitted to receive. The replication concepts guide explains these different scopes.

Use an approved dedicated probe object. Avoid modifying built-in security principals, site links or a real user’s business data for a timing test. Changing a replicated attribute is a directory write even when its original value is restored afterward.

Observe one controlled directory change

You’ll need the AD module, read access on every target, and delegated write permission to description on an existing dedicated test object. Check the target list against the domain inventory first. Save the original values somewhere outside the shell session too, in case you lose it.

Writes the marker, then polls read-only:

$origin = 'DC1.contoso.com'
$targets = @('DC1.contoso.com','DC2.contoso.com','DC3.contoso.com')
$probe = Get-ADObject -Server $origin -Identity `
    'CN=ReplicationProbe,OU=Diagnostics,DC=contoso,DC=com' `
    -Properties description -ErrorAction Stop
$id = $probe.ObjectGUID
$saved = @($probe.description | Where-Object { $null -ne $_ })
$marker = 'ReplicationProbe:' + [guid]::NewGuid().ToString()
$clock = [Diagnostics.Stopwatch]::StartNew()
Set-ADObject -Server $origin -Identity $id `
    -Replace @{description=$marker} -ErrorAction Stop

$firstSeen = @{}
$lastError = @{}
$limit = [TimeSpan]::FromHours(4)
do {
    foreach ($server in $targets) {
        if ($firstSeen.ContainsKey($server)) { continue }
        try {
            $value = Get-ADObject -Server $server -Identity $id `
                -Properties description -ErrorAction Stop
            $lastError.Remove($server)
            if (@($value.description) -contains $marker) {
                $firstSeen[$server] = $clock.Elapsed.TotalSeconds
            }
        } catch { $lastError[$server] = $_.Exception.Message }
    }
    if ($firstSeen.Count -lt $targets.Count) { Start-Sleep -Seconds 5 }
} while ($firstSeen.Count -lt $targets.Count -and $clock.Elapsed -lt $limit)

foreach ($server in $targets) {
    [pscustomobject]@{
        DC = $server
        Seen = $firstSeen.ContainsKey($server)
        FirstObservedSeconds = $firstSeen[$server]
        LastQueryError = $lastError[$server]
    }
}

Seen=false with a query error means the read failed; it doesn’t tell you whether replication failed. A successful read of the old value means the marker hadn’t been observed there at that instant. The stopwatch starts before the write and includes write/ADWS/query time. Serial polling and the five-second pause make arrival times upper bounds at observation resolution, not exact wire latency. One slow query can run past the overall limit before returning control.

The Get-ADObject and Set-ADObject references define GUID identity, explicit server targeting and attribute updates. Polling over ADWS also tests the management path; it is separate from DRS replication connectivity.

Restore deliberately and verify cleanup

Restores the attribute: use the retained $saved, $id and $marker from that test. Refuse to overwrite an unexpected intervening edit:

$current = Get-ADObject -Server $origin -Identity $id `
    -Properties description -ErrorAction Stop
$currentValues = @($current.description)
if ($currentValues.Count -ne 1 -or $currentValues[0] -ne $marker) {
    throw 'Probe changed since the test; review before restoring.'
}
if ($saved.Count -eq 0) {
    Set-ADObject -Server $origin -Identity $id -Clear description -ErrorAction Stop
} else {
    Set-ADObject -Server $origin -Identity $id `
        -Replace @{description=$saved} -ErrorAction Stop
}

Verify restoration on every expected replica too. For disputed results, collect the probe attribute’s originating metadata on each DC. Matching values are useful, but the metadata comparison identifies which originating update arrived.

Interpret timing against topology and workload

Repeat from relevant origins at different phases of the actual schedules. A change immediately before a replication window and one immediately after it can produce very different healthy results. A measurement originating on the PDC is not automatically the worst-case path from a remote writable DC.

Keep the origin/write time, first observations, query failures, target membership, schedules, notification configuration and concurrent workload with the results. Test a DC or site outage separately. Don’t force synchronization during the baseline; that changes what you’re measuring.

If changes take longer to arrive while transport is working, check pending work and data application. Errors 8461/8477 can describe preemption or queued work rather than a broken link. Microsoft’s 8461 analysis explains what to look for in the queue. Repeated forest-wide forced syncs can add higher-priority work and make ordinary work wait even longer.

Measure SYSVOL separately

A directory marker cannot measure DFSR. For an approved SYSVOL propagation test, use dedicated benign content and explicit \\DC\SYSVOL\domain paths, compare the content/hash on each member, then remove it and verify deletion propagation. Record share-access failures separately from a successful read of missing or old content. DFS Management’s propagation test is another intentional file-creation operation; the DFSR FAQ’s monitoring section describes the tool.

Keep file timing, directory timing and client policy processing as separate measurements. A GPO becomes usable only when its required AD and SYSVOL portions are available, and the client must still select/download/process it. Continue with Group Policy troubleshooting when both replication measurements pass.

← All Active Directory topics