Active Directory · Troubleshooting guide

Active Directory Troubleshooting: Replication Failures, DNS Errors and Lingering Objects

A repadmin-driven workflow for the replication incidents that destabilise entire forests: 1311 and 2087 events, DNS misconfiguration and lingering objects.

Published August 28, 2026 · RCW IT Training

Replication diagnosis

Event 1311 or 2087: replication cannot find a partner

Nine times out of ten it is DNS: every DC must resolve every other DC's GUID-based CNAME in the _msdcs zone. Run repadmin /showrepl, dcdiag /test:dns /e, and nslookup <dc-guid>._msdcs.<forest>. Fix stale SRV and CNAME records, confirm dynamic updates work, and verify site links and schedules allow replication. Only after DNS is clean, retry with repadmin /syncall /AdeP.

Lingering objects, or the destination DC is prevented from replicating (8606/8614)

A DC that stayed offline longer than the tombstone lifetime has rejoined. Do not force-replicate: first run repadmin /removelingeringobjects <dc> <source-guid> <partition> /advisory_mode, then for real. If many DCs are affected, enable strict replication consistency and plan to rebuild the worst offenders - lingering objects corrupt the user experience forest-wide.

Health routines

SYSVOL out of sync and GPOs apply inconsistently

Modern domains use DFSR: check dfsrdiag pollad, the DFSR event log (4012/4114), and staging folder space. On persistent mismatch perform an authoritative DFSR sync of SYSVOL from a known-good DC per Microsoft guidance, then verify with gpresult /r on a test client.

Key takeaway: AD replication is DNS first: validate _msdcs resolution before touching anything else, treat long-offline DCs as rebuild candidates, and keep an authoritative SYSVOL runbook.