When repadmin or dcdiag says a domain controller can't replicate, the status code is the fastest way to the root cause. This quick reference lists the Active Directory replication codes Microsoft documents, grouped by what usually breaks: the network, name resolution, authentication, a quarantined DC or the directory database. For each one you get the meaning, the usual cause and the first check to run.
Codes in this quick reference
1722 The RPC server is unavailable: the destination DC can't reach RPC on the source DCrepadmin /showrepl / dcdiag1753 There are no more endpoints available from the endpoint mapperrepadmin /showrepl / dcdiag1256 The remote system is not available: connectivity failure between partnersrepadmin /showrepl / dcdiag1818 The remote procedure call was cancelled: replication RPC timed outrepadmin /showrepl / dcdiag8524 The DSA operation is unable to proceed because of a DNS lookup failurerepadmin /showrepl / dcdiag1908 Could not find the domain controller for this domain: no KDC reachablerepadmin /showrepl / dcdiag5 Access is denied: secure channel, time skew or security settings between DCsrepadmin /showrepl / dcdiag8453 Replication access was denied: missing replication permissionsrepadmin /showrepl / dcdiag
+ 17 more codes in the tables below.
How to read these codes#
Replication status codes are Win32 error numbers. repadmin prints them in decimal with the hex value in brackets, for example Last attempt @ ... failed, result 8524 (0x214c): followed by the message text. dcdiag prints The replication generated an error (8614): and the same text. You also see them in the Replicate Now dialog in Active Directory Sites and Services and inside Directory Service events. Read the code on the destination DC, the one requesting changes; the source is the partner it pulls from.
repadmin /replsummary
repadmin /showrepl DC02
repadmin /showrepl * /csv > showrepl.csv
dcdiag /test:replications /s:DC02 /v/replsummary gives the failure count and largest delta per DC, /showrepl the status of every partition and partner, and the CSV export covers all DCs at once. The ActiveDirectory PowerShell module returns the same data as objects:
Get-ADReplicationFailure -Target contoso.com -Scope Domain |
Select-Object Server, Partner, FailureCount, FirstFailureTime, LastError
Get-ADReplicationPartnerMetadata -Target DC02 |
Select-Object Partner, Partition, LastReplicationSuccess, LastReplicationResult, ConsecutiveReplicationFailuresReplication depends on network connectivity over the AD DS ports, DNS resolution of the partner, authentication and authorization, clocks within five minutes for Kerberos, a healthy database, a correct topology and the replication engine. Work through failures in that order, because one network or DNS fault can surface as several different codes.
Tip: Open showrepl.csv in Excel, filter out deleted DCs (names containing "del") and rows whose Last Failure Time is 0. What's left, sorted by Last Success Time, is your work list.
Network, RPC and name resolution#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
1722 (0x6ba) | The RPC server is unavailable | RPC maps a lower-layer failure: source DC down or unreachable, TCP 135 or the dynamic RPC ports blocked, or the name resolves to the wrong address | Test-NetConnection DC01 -Port 135 from the destination, then confirm the name resolves to the source DC's real IP |
1753 (0x6d9) | There are no more endpoints available from the endpoint mapper | The endpoint mapper answered, but AD DS isn't registered: the service didn't start or failed, or DNS, WINS or a hosts file sent the destination to a different server | Check the name-to-IP mapping, then that Active Directory Domain Services (NTDS) is running on the source |
1256 (0x4e8) | The remote system is not available | Connectivity failure between the partners | Same checks as 1722: reachability, firewalls and name resolution |
1818 (0x71a) | The remote procedure call was cancelled | The destination didn't receive changes within the RPC replication timeout: slow or lossy links, or an overloaded source | Latency and packet loss between the two DCs, and the source DC's load |
8524 (0x214c) | The DSA operation is unable to proceed because of a DNS lookup failure | Catch-all for DNS failures: the source DC's GUID-based CNAME under _msdcs of the forest root or its host record doesn't resolve; events 2087 and 2088 accompany it | dcdiag /test:dns /v on both DCs; on the source, nltest /dsregdns to re-register its records. Microsoft's 8524 article |
1908 (0x774) | Could not find the domain controller for this domain | The destination can't contact a KDC, or Kerberos is failing on it | nltest /dsgetdc:contoso.com /kdc from the destination; its time, DNS client settings and System log |
Authentication and permissions#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
5 (0x5) | Access is denied | Many causes; common ones are a broken secure channel or password mismatch on either DC, time skew beyond the five-minute Kerberos tolerance, a broken trust, or CrashOnAuditFail set to 2 after the Security log filled up | dcdiag /test:CheckSecurityError on the destination, nltest /sc_query:contoso.com, w32tm /monitor. Microsoft's error 5 article |
8453 (0x2105) | Replication access was denied | The destination DC lacks replication rights on the partition (top cause for RODCs: the forest root's Enterprise Read-only Domain Controllers group lacks Replicating Directory Changes on that partition), or the admin who started a manual sync lacks rights | dcdiag /test:NCSecDesc and dcdiag /test:MachineAccount (a DC's userAccountControl is normally 0x82000). Microsoft's 8453 article |
-2146893022 (0x80090322) | The target principal name is incorrect | The source can't decrypt the service ticket the destination presented; top cause: the KDC that issued it still has an old password for the source DC | Microsoft's top fix: set the KDC service on the destination to Disabled, restart it, replicate from the source, then set KDC back to Automatic and start it. Microsoft's article |
1396 (0x574) | Logon Failure: The target account name is incorrect. | The SPN the KDC looks up is missing from the global catalog, its account isn't on the GC, the destination lacks the LSA secret for the source's domain, or the SPN sits on another computer's account | setspn -L DC01, setspn -X -F for duplicates, and name resolution to the right DC |
8589 (0x218d) | The DS cannot derive a service principal name (SPN) ... | A partner was forcibly removed and re-promoted before end-to-end replication finished, or a DC was renamed and its serverReference wasn't updated | The partner's server object under Sites: serverReference must point to its computer account; let replication converge before re-promoting |
Replication disabled or quarantined#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
8456 (0x2108) | The source server is currently rejecting replication requests | Outbound replication on the source is disabled, by an admin or automatically by Windows (USN rollback, low disk space, corrupt up-to-dateness vector). Also fails new DC promotions | repadmin /options DC01 and the Dsa Not Writable value (below). Microsoft's 8456/8457 article |
8457 (0x2109) | The destination server is currently rejecting replication requests | The same causes on the destination: inbound replication disabled | repadmin /options DC02; Directory Service events 2095 (USN rollback), 2103 (unsupported restore) or 1393 (disk space) |
8614 (0x21a6) | Can't replicate with this server because the time since the last replication exceeded the tombstone lifetime | The destination didn't inbound-replicate a partition from the source for longer than the tombstone lifetime (60 or 180 days by default), or its clock jumped forward that far; NTDS event 2042 goes with it | Look for time jumps and lingering objects first. Options: demote and rebuild the stale DC, or remove lingering objects and then lift the quarantine. Microsoft's 8614 article |
When 8456 or 8457 appears without an admin having set DISABLE_INBOUND_REPL or DISABLE_OUTBOUND_REPL, read the quarantine flag:
repadmin /options DC02
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' -Name 'Dsa Not Writable' -ErrorAction SilentlyContinue
# 1 = forest version incompatible with the OS 2 = not enough free disk space for the database or logs
# 4 = USN rollback (VM snapshot, bad P2V or unsupported restore) 8 = corrupt up-to-dateness vector
# Values can combine: 10 = 2 + 8Watch out: Don't just remove the options or the quarantine on a DC whose USNs rolled back (value 4) or whose up-to-dateness vector is corrupt (value 8): it spreads bad data. Follow Microsoft's USN rollback recovery for event 2095, and demote and re-promote a DC with value 8. Value 2 is fixed by freeing disk space.
Directory consistency and lingering objects#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
8606 (0x219e) | Insufficient attributes were given to create an object | The source sent an update for an object the destination had already deleted and garbage-collected (a lingering object on the source), and the destination runs strict replication consistency | Event 1988 on the destination names the object and source; remove lingering objects (below) |
8240 (0x2030) | There is no such object on the server | The object being processed isn't in the directory; also reported inside NTDS event 1126 | Identify the object or partition from the full message, then compare it on both DCs with repadmin /showobjmeta |
8333 (0x208d) | Directory object not found | Database corruption (with related errors on the source), lingering objects, conflict objects or a third-party process | Directory Service log on the source for database errors; an advisory-mode lingering object check |
8545 (0x2161) | Replication update could not be applied ... | The source sent changes for a recently moved object while the destination still holds it in another partition (cross-domain move) | Let the partitions involved replicate end to end; it normally clears once both DCs know about the move |
8452 (0x2104) | The naming context is in the process of being removed or is not replicated from the specified server | The topology on the DC starting replication differs from the destination's copy, typically after DCs or partitions were added or removed | Let the Configuration partition converge, then run repadmin /kcc on the destination |
Removing lingering objects#
Compare the DC that holds lingering objects with a healthy reference DC (use the reference DC's DSA object GUID from repadmin /showrepl). Run in advisory mode first, which only reports, and check the Directory Service log for the results.
repadmin /removelingeringobjects DC02.contoso.com <DC01-DSA-object-GUID> DC=contoso,DC=com /advisory_mode
:: Review the results, then run the same command without /advisory_modeSchema, database, disk and memory#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
8418 (0x20e2) | The replication operation failed because of a schema mismatch between the servers involved | Schema information differs between the partners, often right after a schema update | Let the schema partition replicate from the schema master first, then retry |
8464 (0x2110) | Synchronization attempt failed | An attribute was added to the partial attribute set, which triggers a PAS synchronization on global catalogs | Expected after such a schema change; give the global catalogs time to finish |
8451 (0x2103) | The replication operation encountered a database error | Several causes, mostly in the NTDS database or the storage under it | Directory Service log for database errors and disk health; follow Microsoft's 8451 guidance before any repair |
8446 (0x20fe) | The replication operation failed to allocate memory | The replication engine can't allocate memory | Available memory on the DC and the processes using it |
1127 (0x467) | While accessing the hard disk, a disk operation failed even after retries | Storage failing under the AD database or logs | System log for disk and controller errors on the volume that holds NTDS |
8477 (0x211d) | The replication request has been posted; waiting for reply | Informational: replication from the source is in progress and not yet applied | Nothing to fix; check again later |
How to verify a fix#
- On the destination DC, trigger replication of all partitions from all partners and read the result:
repadmin /syncall /Ade
repadmin /showrepl DC02
dcdiag /test:replications /s:DC02
repadmin /replsummaryrepadmin /showreplshowsLast attempt @ ... was successful.for every partition and partner.- dcdiag ends with
DC02 passed test Replications. - In
repadmin /replsummarythe fails/total column is 0 for every DC and the largest delta is within your replication schedule. Get-ADReplicationPartnerMetadatashowsLastReplicationResult0 and a freshLastReplicationSuccess.- No new replication errors in the Directory Service log. The events that go with these codes (1311, 1925, 1988, 2042, 2087, 2088 and others) are covered in Active Directory event IDs: Directory Service, Netlogon and DNS.
SYSVOL is replicated separately (by DFSR, or FRS in domains that never migrated), so a clean repadmin doesn't prove Group Policy files are in sync; see SYSVOL replication events. Kerberos result codes behind errors 5, 1396 and -2146893022 are decoded in Kerberos error codes in events 4768, 4769 and 4771.
