Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I have a group policy, and add a group/user/machine etc to that group policy, how long is it until all domain controllers have that change in effect?

This is a Windows 2003 Domain set up with controllers at different geographic locations (Each with a different L3 network).

I realize it probably depends, but how do I figure out how long it generally takes for my given setup? Also, is there an event I can check to see if it has a reached a particular domain controller?

share|improve this question
Are you saying that the gpo applies to a group, and you are adding a user/group/machine to that group? That would be an important distinction. – Greg Askew May 4 '10 at 16:10
Hmmm... in this case adding a user to the GPO, but I would be interested in an explanation as to how those to scenarios will be different in replication more than a specific answer. – Kyle Brandt May 4 '10 at 16:21
up vote 2 down vote accepted

Group policy is replicated with the rest of the information that is replicated during a normal AD replication cycle as well as the FRS replication cycle. So to check how long it would take to replicate you would need to look at Sites and Services to see what your replication interval is between sites. This would give you a maximum time to replication. I am not aware of any way to see how long from now (i.e. I'm in between cycles how long to the next replication) it will take to replicate.

If the change is something that needs to be replicated right away you can force a manual replication in Sites and Services.

share|improve this answer
Where is that within in sites and services? – Kyle Brandt May 4 '10 at 14:21
Default site ip link in the interlink transports? There is also the NTDS schedule, is that the same thing with one overriding the other, or are those different things? – Kyle Brandt May 4 '10 at 14:25
@Kyle: Correct, the Default is well the default and can be overridden by the NTDS Schedule. – Zypher May 4 '10 at 14:44
Okay, couple more questions :-) So, If I set a particular to site to a faster schedule. That means it propagates its changes to the rest on that schedule? Or Propagates and receives? Secondly, is there a list of things that get pushed right away vs things that have to wait for replication? For example, password changes seem to happen right away... – Kyle Brandt May 4 '10 at 15:20
@Kyle: If you set it at the default inter-site transport it will be propagation, and receives for every site in that transport. If you set it per link, it will be inbound from the server specified. Yes there is a really good MSDN article about that ... i just need to find it again :) – Zypher May 4 '10 at 15:29

In Windows 2003, group policies are replicated with sysvol, which is FRS. FRS replicates right away, which means whenever it feels like it. You can monitor the status using UltraSound:

Windows 2003 R2 and later use DFS for sysvol replication. Dfsrdiag is the tool of choice for monitoring and testing replication.

share|improve this answer

It depends TOTALLY on your setup - if you have various geographical setups, configuration path and times can be configured. Maybe yours are configured to only sync once per day, and sync from you to a server is over 2 steps? We do not know - your admin should know.

share|improve this answer

I agree with TomTom, where I used to work had a network setup of 6000+ workstations, with servers upto 30 miles apart, sometimes only with a 10Mb/s link between server sites. Depending on network load and conditions at the time, on occasion replication could take up to 2 hours. I wouldn't say it has taken longer than 2 hours... Bear in mind that the network link between servers in this instance would have been running at a massive load all day.

share|improve this answer
I was working at MS once in Munich, and my newly created AD accounts took a day to get down to munich local servers - as MS internally seems to replicate certain things on intervals ;) – TomTom May 5 '10 at 9:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.