How to Force Active Directory Replication using PowerShell

The Challenge of Multi-Site Topologies

In a large enterprise environment, you likely have multiple Active Directory Domain Controllers spread across different geographical locations (e.g., a primary server in New York, and a secondary server in London). By default, Active Directory is highly optimized to save network bandwidth. If a Helpdesk technician in New York resets a user’s password, the New York Domain Controller might wait up to 15 minutes before replicating that change across the WAN link to the London server.

If the user is currently standing in the London office trying to log into their computer, they will be denied access until that replication occurs. While you can open the “Active Directory Sites and Services” graphical interface to manually force a sync, this tool is incredibly sluggish. PowerShell allows you to trigger an immediate, cross-site replication in seconds.

Using the Sync-ADObject Cmdlet

To execute these commands, you must be running PowerShell with Domain Administrator privileges and have the Active Directory module (RSAT) installed.

The most precise way to force replication is to use the Sync-ADObject cmdlet on the specific user account that was just modified. This avoids flooding the network with a full database sync.

Assume the user’s login is JSmith. Run the following command:

Get-ADUser JSmith | Sync-ADObject -Destination "LON-DC-01" -Source "NY-DC-01"

Breaking Down the Parameters:

• Get-ADUser JSmith: Retrieves the exact Active Directory object for the user.
• -Source: The hostname of the Domain Controller where the password was just changed (New York).
• -Destination: The hostname of the Domain Controller that urgently needs the updated password (London).

The command executes silently, and the London Domain Controller will instantly accept the new password hash.

Forcing a Full Replication (Repadmin Replacement)

If you have just made massive changes—such as creating 50 new security groups or modifying the domain schema—syncing individual objects is inefficient. You need to force a full replication of the entire directory partition.

Historically, administrators used the clunky command-line tool repadmin /syncall. In modern PowerShell, this is achieved using the Invoke-Command to trigger the sync.

To force the London server to immediately pull all updates from all of its replication partners, run:

Invoke-Command -ComputerName "LON-DC-01" -ScriptBlock {repadmin /syncall /A /e /d /P /q}

Note: While PowerShell Cmdlets exist for forcing full topology syncs, using Invoke-Command to trigger the highly optimized Repadmin executable remains the industry standard for full-site replication due to its speed and comprehensive logging.

Verifying Replication Health

After forcing a sync, you should verify that it actually succeeded. A broken WAN link or a firewall issue might prevent the servers from communicating.

Get-ADReplicationPartnerMetadata -Target "LON-DC-01" | Select-Object Server, LastReplicationSuccess

This will output a clean table showing the exact timestamp of the last successful handshake between your Domain Controllers, proving that your forced sync was successful.