Microsoft Windows AD Force Intersite Replication and Force DNS Update

Based on site topology, there are two forms of Active Directory replication, Intrasite, and Intersite. All domain controllers inside the same site replicate each other in intrasite Replication. Selected Domain controllers from two distinct sites will replicate during a defined interval in Intersite Replication. BridgeHead Servers are domain controllers that are responsible for site replication.

Intrasite Replication:
Change notification triggers intrasite Replication, which happens automatically. When you make a directory update on a domain controller, intrasite Replication starts. The source domain controller waits 15 seconds before sending an update notification to the replication partner closest to it. If the source domain controller has multiple replication partners, subsequent notifications are sent to each partner at 3-second intervals by default. A partner domain controller sends a directory update request to the source domain controller after receiving a change notification. The source domain controller performs a replication operation in response to the request. The 3-second notification period keeps the source domain controller from being inundated with update requests from its replication partners at the same time.

Domain controllers, on the other hand, will not wait 15 seconds for some directory modifications. Urgent Replication is the term for this case. Some directory updates, such as account lockout assignments and changes to account lockout policies, domain password policies, or domain controller account passwords, are examples of Urgent Replication.

Interval:  15 Seconds w/ 3 second subsequent delay notifications

Intersite Replication:
Intersite Replication occurs when replication partners from two different sites. By reducing the frequency of Replication and allowing you to plan the availability of site links for Replication, Active Directory helps you save bandwidth between sites. Intersite Replication over each site link occurs every 180 minutes, or 3 hours, by default. This replication interval can be changed, and it can be reduced to 15 minutes. However, it is usually recommended to leave the default interval because intersite Replication happens across low-speed WAN links, and decreasing the replication interval could result in increased network traffic and latency.

Interval:  180 minutes or 3 hours

But, you do have an option to do an update synch immediately by using the “USE_NOTIFY” option.  This feature is configured in Sites and Services under Sites, Inter-Site Transports, IP:

Doing this is not recommended but you do have the option.  Use with caution and make sure you test it first.

DNS Replication:
These one more replication I want to bring up because a lot of people are probably trying to synch their DNS changes across sites.  DNS changes are polled every 15 minutes by default for AD integrated zones.  This means, even if AD is synched, DNS won’t be polled automatically and you might have to wait up to 15 minutes.


There are two things you need to do to update DNS changes right away between AD Sites.  First, you force the Intersite replication; then, you force a zone update from the AD DS. If you’re like me, I like to script things to automate processes so you can use these commands.

1. Force AD Intersite Replication 

repadmin /syncall /AdeP

The flags in the following list are supported.

/a Aborts, if any server is unavailable.
/A Synchronizes all naming contexts that are held on the home server.
/d Identifies servers by distinguished name in messages.
/e Sychronizes domain controllers across all sites in the enterprise. By default, this command does not synchronize domain controllers in other sites.
/h Displays Help.
/i Iterates indefinitely.
/I Runs the repadmin /showrepl command on each server pair in the path instead of synchronizing.
/j Synchronizes adjacent servers only.
/p Pauses after every message to allow the user to abort the command.
/P Pushes changes outward from the specified domain controller.
/q Runs in quiet mode, which suppresses call back messages.
/Q Runs in very quiet mode, which reports fatal errors only.
/s Does not synchronize.
/S Skips the initial server response check.

2. Force the DNS zone to Poll the AD Database

dnscmd /zoneupdatefromds {zone name}
More Stories
Splunk Queries