We help IT Professionals succeed at work.

Active Directory not Replicating over WAN

noahstevens asked
I am very new at this, but my company just set up a site to site VPN between our headquarters and a branch office using two Cisco 2801 routers.  I have tested the VPN, and I have full connectivity.  I can pint all systems on both ends and access file shares.

I shipped out a Windows Server 2003 R2 box to the branch location and promoted it as a domain controller in our existing domain.  The promotion seemed to be successful.  I added a new subnet and site for the branch office in Acive Directory, and I can see all of our users on the branch office domain controller.

I was looking at the Directory Service logs on my headquarters domain controller, and it seems that the servers are NOT replicating properly.  I am getting an Event ID 1925 with the following error:

The attempt to establish a replication link for the following writable directory partition failed.
Directory partition:
Source domain controller:
CN=NTDS Settings,CN=xxxxx,CN=Servers,CN=xxxxx,CN=Sites,CN=Configuration,DC=xxxxx,DC=net
Source domain controller address:
Intersite transport (if any):
CN=IP,CN=Inter-Site Transports,CN=Sites,CN=Configuration,DC=xxxxxx,DC=net
This domain controller will be unable to replicate with the source domain controller until this problem is corrected.  
User Action
Verify if the source domain controller is accessible or network connectivity is available.
Additional Data
Error value:
1722 The RPC server is unavailable.

I have x'ed out any company information, but I am afraid the longer that I wait we might run into synchronization problems, so your help is greatly appreciated!

Let me know if you need any additional information regarding this.

Thank you very much for all your help!
Watch Question

How have you confirmed that you have full connectivity?  It's entirely possible that your DCs can ping each other but are unable to transmit RPC traffic, for example.  You should also confirm DNS name resolution between sites; issue an 'nslookup domain.com' the remote site and confirm that it returns the IP addresses of one or more domain controllers.
Typically RPC Server is Unvailable is either one of the following:

DNS isn't configured properly

You really have a network issue between the two

Make sure you are not pointing the DNS client to any non domain DNS servers.
You pay try pointing the server at the other DC that has been up longer for DNS and then try to force replication and see if that helps.

Also,  if you are not running SP2 on the servers you may upgrade.  There is a known issue with SP1 level machines across some VPN's.

You can download portquery from microsoft and try to hit the following ports on the home office DC from the remote office:

Port 88 (kerberos)
Port 389 (ldap)
Port 445 (SMB)


I just checked and there is name resolution between the two sties.  The branch office domain controller is pointing to the headquarters office for DNS.  Both of the headquarters domain controllers are running SP2.  I have also performed an nslookup on the branch office domain controller and it pulls up all of my domain controllers.

I am also getting the following error message on the BRANCH domain controller:

The following directory partition is no longer replicated from the source domain controller at the following network address because there is no Connection object for the domain controller.
Directory partition:
Source domain controller:
CN=NTDS Settings,CN=HEADQUARTERS,CN=Servers,CN=xxxxx,CN=Sites,CN=Configuration,DC=xxxx,DC=net
Network address:

I am completely lost here!
Install the Windows Support Tools and run dcdiag and netdiag from both domain controllers to see if these produce any relevant error messages.


I just did a dcdiag and it seemed to pass.  I was playing around with Active Directory Sites and Services and I assigned a cost of 1 to the site link, and it seems like everybody is playing nice now!  I am going to split  the points, and hopefully this resolved the issue!  Thank you for all of your help!