Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two Windows Server 2012 Virtual Machines with Active Directory Domain Services installed. They are both Domain Controllers on the same domain, and both are running DNS servers.

When both machines are running, I create a new user on AD1(the first machine I setup). This new user does not replicate to AD2(the second machine).

When I create a new user on AD2, it replicates to AD1 without issue.

There are a number of errors in the event logs for AD1, but despite extensive Googling, I can't quite figure out how to solve the issue. I've been trying for a few days and I'm at my wits' end. Sometimes the error is from the DFRS, sometimes it's from the Domain Services itself.

I'd be happy to post any and all error messages if anyone is interested - any help would be unbelievably appreciated; I just can't seem to lick this :(

(Quick edit: The latest errors state: There are no more endpoints available from the endpoint mapper.)

share|improve this question

migrated from Aug 19 '12 at 11:01

This question came from our site for professional and enthusiast programmers.

Domain controllers are using RPC to do replication among themselves. For some reasons, your RPC on one of the domain controllers is not working properly. There can be multiple reasons. Please check this KB – Harvey Kwok Aug 18 '12 at 19:03

It sounds like there is a firewall between the two. In 2008 R2 you need to be able to communicate on ports:

  1. 135 - to map endpoints
  2. 445 - Sysvol
  3. 5722 - FRS (if you're using it)
  4. 49152-65535 - RPC

There are more ports needed for actual logins, etc, but these are the minimum needed for replication.

share|improve this answer
As for RPC, you can change this behavior in the registry. RPC opens a conversation on a set port, but then negotiates a higher port. If you need these to be explicit, that can be done, it will require a reboot per DC though, just an FYI. This can make firewall configuration a little easier. I typically do this when servers in a DMZ need to maintain membership in AD. – SpacemanSpiff Aug 19 '12 at 15:10
Firewalls on both machines were completely disabled prior to installing Active Directory. – TheSciz Aug 20 '12 at 14:52
The proper rules are made on the Windows client firewalls during dcpromo anyway. I was referring to a hardware firewall or third parts software that might not be configured for replication. – MDMarra Aug 20 '12 at 14:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.