We recently implmented a way to allow users to unlock accounts themselves after too many invalid password attempts. It is working great, but we are having an issue with replicating account unlocks across sites (with Active Directory on Windows Server 2008 R2). Lockouts replicate to all domain controllers immediately but unlocks only unlock immediately in the site they are unlocked and then take 15 minutes to replicate to the other sites.

I have been searching for a setting that would allow unlocks to be replicated across all sites immedaitely but I am not havning any luck. Does anyone know how to replicate unlocks immediately?

Thank you for your input.


By default, account unlock is not urgently replicated. You can configure Urgent Replication for the Unlock Account operation: http://technet.microsoft.com/en-us/library/cc772726%28v=ws.10%29.aspx#w2k3tr_repup_how_huzs

| improve this answer | |
  • a couple things the fastest you can update items that are urgent is 15 minutes, secondly I don't think unlock events are urgent, just locking events. – tony roth Jun 14 '13 at 18:47
  • >the fastest you can update items that are urgent is 15 minutes Are you sure about that? – Eugene Pavlov Jun 14 '13 at 18:52
  • haven't needed to make this change before so I don't know for sure. – tony roth Jun 14 '13 at 19:24
  • I guess I should ask do you see anything in the doc that suggests it could be less then 15 minutes? – tony roth Jun 14 '13 at 19:31
  • 1
    Urgent replication is implemented immediately by using RPC/IP to notify replication partners that changes have occurred on a source domain controller. – Eugene Pavlov Jun 14 '13 at 19:58

If you have high-speed WAN connectivity between your sites (like T1 or higher) and you're not constantly replicating tons of data in AD, you can enable change notify on your site links in AD. This will cause replication between sites to happen as quickly as intra-site replication (a few seconds). This changes the "pull" model of inter-site replication to a "push" model.

Note that this will cause all replication to happen between sites instantly, not just lockouts and it will disable the compression that is normally used on inter-site replications. That said, most modern ADs are good candidates for this with 10Mb+ WAN connections being quite common.

| improve this answer | |

hmm you could do a powershell command and run a remote ps sessions to each AD site and have them issue the unlock, haven't tried this but it will work.

| improve this answer | |
  • 2
    alternatively you could make your unlock application site aware. – tony roth Jun 14 '13 at 15:43
  • The program is site aware, but we have some people doing remote desktop into other sites... when they get locked out in the distant site, it takes 15 minutes to replicate back to the site they are originating the request from. – adivis12 Jun 14 '13 at 15:48
  • I'll look into doing that with powershell, but I'm not completely sure how I would initiate that script for a particular user. The program unlocking is 3rd party software that doesn't have any way to tie into it. – adivis12 Jun 14 '13 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.