Making Active Directory changes atomic

Question

I've got a Windows 2003 Active Directory infrastructure, and there are times (such as when terminating an employee) that I want instantaneous propagation across both of my AD servers. Currently, I make the change in both places, which I suspect is unhealthy, but it's the only way I know to make sure that the account is disabled to every machine.

Is there a better way? Do I have to wait for the normal propagation time for convergence, or is there a way to "force" it?

score 8 · Accepted Answer · edited May 04 '19 at 14:26

8

If you go into Active Directory Sites and Services, you can force replications. Open the Server object and click on the NTDS Settings. This will give you a list of their replication partners for GC data as well as regular DC-DC traffic. As I understand it, you can force replication by going to each of the connections, right-clicking on it, and choosing "Replicate Now".
_{(source: sysadmin1138.net)}

edited May 04 '19 at 14:26

Glorfindel

1,213
4
15
22

answered Aug 12 '09 at 15:24

sysadmin1138

133,124
18
176
300

Bang on! Always make the first change on the users local DC will also help. – Kip Aug 12 '09 at 15:32
This initiates a "pull" of data, not a push. Try this instead: repadmin /syncall /P /e sourceDC1.domain.local – Ryan Fisher Apr 06 '10 at 16:32

Dayton Brown · Answer 2 · 2009-08-12T16:13:00.083

8

There is an even easier change. Just reset the users password. That is one of the few instant replications that AD performs. No need to run site replication

EDIT:

Small edit. It's not completely instant. What is does is forward the change in an out-of-band update. (It doesn't wait for normal replication cycles)

however, it's probably about as close to instant that you can get with AD.

edited Aug 12 '09 at 16:13

answered Aug 12 '09 at 15:48

Dayton Brown

1,539
2
13
23

Good thinking. I like this. – phuzion Aug 12 '09 at 15:52
Nice! that works for when my non techie staff need to do this – Kip Aug 12 '09 at 15:53
+1 This is the best option for the small one-offs such as when terminating an employee. – squillman Aug 12 '09 at 15:55
To pile-on, this is the best answer IMO. It also dovetails nicely with documenting the new password and giving it to the helpdesk or the person's boss, depending on your policies. – mfinni Apr 06 '10 at 17:33

score 3 · Answer 3 · answered Apr 06 '10 at 16:30

Remember when you play with forcing replication, all replication links are one-way, incoming. If you want to push changes outbound from a DC via the Sites & Services console, you have to go to each replica-partner and PULL from the source DC.

There is an easier way to force "outbound-full-replication" using the repadmin.exe tool from the Windows 2003 SP1 Support Tools kit:

repadmin /syncall /P /e sourceDC1.domain.local

This will push the changes via all replication links, outward from your source DC, for the default naming contaxt (which is where your user data is).

Hopefully Matt will come back and select a new answer. This is the best way to go (or at least, quickest). — Doug Luxem, Apr 06 '10 at 16:38

Izzy · Answer 4 · 2009-08-12T15:38:30.077

Make the change to one domain controller. Then open up AD Sites and Services. Then drill down to each site, Servers, DC, NTDS Settings, then right-click each connection and choose Replicate Now.

Note: Each connection will tell you the From Server and To Server for the replication.

Note: Obviously, start the first replication From the DC you made the change on.

If you have a small domain, this shouldn't be too taxing a task. If you have a larger domain (more DCs) then you could script this.

To script, you need to use the CMD command called REPADMIN. For a full description of the command type REPADMIN /?. In short, you would use the command in a way similar to this:

REPADMIN /replicate DC1.yourdomain.loc DC2.yourdomain.loc dc=yourdomain,dc=loc /u:yourdomain\your_domain_admin_account

To find out the replication partnerships for a specific DC from the command line type the following:

REPADMIN /showrepl DC1.yourdomain.loc

Once you have figured out the right path/order to replicate to all your DCs, you can just dump all the commands into a batch file, and execute it when you need to replicate changes out quickly.

score 3 · Answer 5 · answered Aug 12 '09 at 16:03

Here's a Technet article that outlines the AD replication model. Look at the Urgent Replication section for a discussion of what gets replicated immediately and doesn't require a forced replication. Mostly it's critical user security events (password changes, account lockouts) that are replicated immediately. There are configuration considerations to be made to make this happen site to site.

score 0 · Answer 6 · answered Aug 12 '09 at 15:32

0

There 's also the possibility to make this using repadmin.exe with the /sync switch or you can even script it using ReplicaSync wich is included in the IADsTools.

You might see this kb article wich discuss the availables options.

answered Aug 12 '09 at 15:32

Maxwell

5,076
1
26
31

Making Active Directory changes atomic

6 Answers6