Active Directory not Replicating over WAN

Posted on 2008-01-28
Medium Priority
Last Modified: 2010-03-17
I am very new at this, but my company just set up a site to site VPN between our headquarters and a branch office using two Cisco 2801 routers.  I have tested the VPN, and I have full connectivity.  I can pint all systems on both ends and access file shares.

I shipped out a Windows Server 2003 R2 box to the branch location and promoted it as a domain controller in our existing domain.  The promotion seemed to be successful.  I added a new subnet and site for the branch office in Acive Directory, and I can see all of our users on the branch office domain controller.

I was looking at the Directory Service logs on my headquarters domain controller, and it seems that the servers are NOT replicating properly.  I am getting an Event ID 1925 with the following error:

The attempt to establish a replication link for the following writable directory partition failed.
Directory partition:
Source domain controller:
CN=NTDS Settings,CN=xxxxx,CN=Servers,CN=xxxxx,CN=Sites,CN=Configuration,DC=xxxxx,DC=net
Source domain controller address:
Intersite transport (if any):
CN=IP,CN=Inter-Site Transports,CN=Sites,CN=Configuration,DC=xxxxxx,DC=net
This domain controller will be unable to replicate with the source domain controller until this problem is corrected.  
User Action
Verify if the source domain controller is accessible or network connectivity is available.
Additional Data
Error value:
1722 The RPC server is unavailable.

I have x'ed out any company information, but I am afraid the longer that I wait we might run into synchronization problems, so your help is greatly appreciated!

Let me know if you need any additional information regarding this.

Thank you very much for all your help!
Question by:noahstevens
  • 2
  • 2
LVL 30

Expert Comment

ID: 20761551
How have you confirmed that you have full connectivity?  It's entirely possible that your DCs can ping each other but are unable to transmit RPC traffic, for example.  You should also confirm DNS name resolution between sites; issue an 'nslookup domain.com' the remote site and confirm that it returns the IP addresses of one or more domain controllers.
LVL 11

Accepted Solution

PlaceboC6 earned 1000 total points
ID: 20762697
Typically RPC Server is Unvailable is either one of the following:

DNS isn't configured properly

You really have a network issue between the two

Make sure you are not pointing the DNS client to any non domain DNS servers.
You pay try pointing the server at the other DC that has been up longer for DNS and then try to force replication and see if that helps.

Also,  if you are not running SP2 on the servers you may upgrade.  There is a known issue with SP1 level machines across some VPN's.

You can download portquery from microsoft and try to hit the following ports on the home office DC from the remote office:

Port 88 (kerberos)
Port 389 (ldap)
Port 445 (SMB)


Author Comment

ID: 20763882
I just checked and there is name resolution between the two sties.  The branch office domain controller is pointing to the headquarters office for DNS.  Both of the headquarters domain controllers are running SP2.  I have also performed an nslookup on the branch office domain controller and it pulls up all of my domain controllers.

I am also getting the following error message on the BRANCH domain controller:

The following directory partition is no longer replicated from the source domain controller at the following network address because there is no Connection object for the domain controller.
Directory partition:
Source domain controller:
CN=NTDS Settings,CN=HEADQUARTERS,CN=Servers,CN=xxxxx,CN=Sites,CN=Configuration,DC=xxxx,DC=net
Network address:

I am completely lost here!
LVL 30

Assisted Solution

LauraEHunterMVP earned 1000 total points
ID: 20764254
Install the Windows Support Tools and run dcdiag and netdiag from both domain controllers to see if these produce any relevant error messages.

Author Comment

ID: 20771062
I just did a dcdiag and it seemed to pass.  I was playing around with Active Directory Sites and Services and I assigned a cost of 1 to the site link, and it seems like everybody is playing nice now!  I am going to split  the points, and hopefully this resolved the issue!  Thank you for all of your help!

Featured Post

Easily manage email signatures in Office 365

Managing email signatures in Office 365 can be a challenging task if you don't have the right tool. CodeTwo Email Signatures for Office 365 will help you implement a unified email signature look, no matter what email client is used by users. Test it for free!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the absence of a fully-fledged GPO Management product like AGPM, the script in this article will provide you with a simple way to watch the domain (or a select OU) for GPOs changes and automatically take backups when policies are added, removed o…
High user turnover can cause old/redundant user data to consume valuable space. UserResourceCleanup was developed to address this by automatically deleting user folders when the user account is deleted.
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

589 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question