Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A few times over the last few months, users have complained about extremely long password change wait times. I can't find anything about this anywhere. Is there a common cause for something like this? We're using Windows 7 and Windows XP on a Windows 2003 domain.

Addenda: I have only one site with two domain controllers. I'm not aware of any replication issues. dcdiag /test:replications passed with flying colors and repadmin /showrepl shows successful replications. If you have any other specific tests you'd like me to try, let me know.

repadmin /syncall & repadmin /showrepl show no errors and execute almost instantly.

share|improve this question
Do you have many domain controller ? Did you check if this is not a replication problem ? – radius Jul 1 '10 at 14:16
Try repadmin /syncall, wait 30 seconds then repadmin /showrepl and see if anything shows something other than successful. – Chris S Jul 1 '10 at 19:11

How many domain controllers do you have and how many sites do you have? If several sites what are the link speeds like?

share|improve this answer

You may want to check on your PDC emulator FSMO role holder for any issues. Check performance counters on your domain controllers. Run DCDiag /c /v >dcdiag.log and see if there are any failures.

share|improve this answer
No failures of any kind on the "dcdiag /c /v > dcdiag.log" test. – pk. Jul 1 '10 at 15:28

On the Microsoft Website, there is a tool called AD Lockout, I think it is part of the Resource Toolkit. While it is designed to show you which DC locked out an account, it also displays the number of failed logins, and time of most recent failure. You could change a password on a test user, then logout/login and look for which DC is failing the password. This may give you a clue...

share|improve this answer

Random thought, but what about clock time synchronization between machines?

share|improve this answer
Good thought, but everything is in sync. The client machine that performed the password change and both DCs are right on. – pk. Jul 1 '10 at 19:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.