Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have created a domain level GPO that causes the message "Logon is prohibited to unauthorized personnel" to be presented to users when logging on.

I need to modify the GPO such that the domain controller group policy replication is set to occur every 15 minutes and computer group policy replication to occur once every 3 hours.

Could someone tell me a tool I need that could help me verify replication timing? Also it would be nice if someone could show me how to set it up as well.

share|improve this question
When you say "replication," do you mean of objects between domain controllers (AD Replication) or policy settings between clients and the domain (GP Updates)? They are two separate things with two separate answers. – Hyppy Jul 16 '11 at 18:58
I am not sure I understand your question.Are you inquiring about policy processing and refresh intervals (i.e. how often the policies applicable to a user/computer are read and processed in the background)? Or literally about replicating a change done to a GPO to other DCs? – maweeras Jul 16 '11 at 19:05
I think it may be that. – Grace Jul 16 '11 at 19:09
@Grace Which "that?" – Hyppy Jul 16 '11 at 19:16
If we're going by beliefs, I believe that this is a homework question. That's just me, though. – Hyppy Jul 16 '11 at 19:45

AD (NTDS) replication is controlled within the AD Sites and Services management console (dssite.msc). You can modify the site links and NTDS settings within there.

For modifying how often clients refresh their policy, you should use Group Policy. Navigate to Computer Configuration > Policies > Administrative Templates > System > Group Policy, and change the Group Policy Refresh Interval settings.

share|improve this answer

You can use the tool repadmin to inspect connections between AD domain controllers:

You can use Repadmin.exe to view the replication topology, as seen from the perspective of each domain controller. In addition, you can use Repadmin.exe to manually create the replication topology, to force replication events between domain controllers, and to view both the replication metadata and up-to-dateness vectors (UTDVECs). You can also use Repadmin.exe to monitor the relative health of an Active Directory Domain Services (AD DS) forest.

For investigating a specific client, you can use gpresult to learn about:

  • When Group Policy was last applied
  • The domain controller which applied Group Policy
  • Information on all GPOs that are applied, and details for these
  • Information on the Registry settings that are applied, and details for these
  • Scripts
  • Software management information and details on published and assigned applications
  • Disk quota information
  • Internet Protocol (IP) security settings
  • Redirected folder information, and details on these.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.