Quick question on Active Directory replication. The AD topology is simple: Hub site and 10 Branch sites. I have one connection object between Branch "A" DC and Hub DC in Active Directory Sites and Services. Does it mean that Branch "A" DC has only one replication partner? If so, why do I see replication error ID 1864 on the Branch "A" DC related to domain controllers in other sites?

Event Type: Error
Event Source:   NTDS Replication
Event Category: Replication 
Event ID:   1864
Date:       6/4/2015
Time:       12:16:08 PM
Computer:   ABranchDC
This is the replication status for the following directory partition on the local domain controller. 

Directory partition:

The local domain controller has not recently received replication information from a number of domain controllers.   The count of domain controllers is shown, divided into the following intervals. 

More than 24 hours:
More than a week:
More than one month:
More than two months:
More than a tombstone lifetime:
Tombstone lifetime (days):

I know that there are some DCs in other branch sites that were not properly demoted. Working on that. But I'm curious, why do I see those errors? Only one partition error is shown here, while I'm getting the same error for Configuration, Schema and DomainDnsZones also.


By default AD ( specificify the KCC and ISTG) assume that the network is fully routed and ALL sites have IP connectivity (ping, RPC, etc) to all other sites. If even one site does not have connectivity to all others then Bridge All Site Links (BASL) must be disabled and individual site links must be added and configured for each site to site link. This would be be case in hub and spoke topology with main and branch offices where the branch offices cannot connect to each other.

If network is not fully routed then Disable Bridge All Site Links (BAS):

  • Active Directory Sites and Services, Sites, Inter-Site Transport.
  • Right click on IP, select Properties, uncheck "Bridge All Site Links" Uncheck BASL

Rename the existing site link to reflect which sites are connected, ie Home-Branch1 Remove the new site(s) from the Home-Branch1 link. Add New Site Links

  • Create a new Site Link, include the 2 sites, ie Home and Branch2.
  • Repeat until there is a site link between each routed site connection, ie Home and all Branch sites.
  • Generally, for sites w/ good connectivity then 15-30 minute replication intervals is best.

Remove Automatically Generated Sites that do not physically exist.

  • If BASL was enabled when the a new site was created but the new site is not fully routed then 1 or more Site Links are bad and need to deleted.
  • Expand any sites that are not fully routed, find the bad site link, it will be labeled "automatically created" and delete the link.

Run the KCC to fix replication topology - The KCC runs every 15 minutes but can be forced. - Run "repadmin /kcc" on the local DC. - Run "repadmin /kcc /Homeserver:%OtherDC%" for every other DC in the organization.

Confirm Replication looks correct.

  • Run Repadmin /showrepl on the local DC.
  • Run Repadim /showrepl %OtherDC% for every other DC in the organization.
  • For each of the above it should only show the site links you expect. Repeat above until it is all correct.

Site Link Bridges

  • Allow for transitive replication between 2 non-routed sites, ie Branch1-Branch2 via MainOffice.
  • Site link bridges are only necessary if a site contains a domain controller hosting a directory partition that is not also hosted on a domain controller in an adjacent site, but a domain controller hosting that directory partition is located in one or more other sites in the forest. Adjacent sites are defined as any two or more sites included in a single site link.
  • OTOH: If your network is not fully routed, site link bridges should be created to avoid impossible replication attempts.

What is the correct way to configure AD replication in a hub-spoke design

  • thanks for the info. "Bridge All Site Links" option is indeed enabled, but when I run repadmin /showrepl on the branch DC I only see Hub DC as a replication partner. So my understanding was that replication can only occur between hub and spoke even if BASL is enabled. By the way, I don't have any other replication issues except of this 1864 error... – Vadym Rybitskyy Jun 5 '15 at 15:23
  • If understand correctly, there is an 1864 error listing 4 unknown/unnamed DC's. There are no unknown or extra replication partners in repadmin /showrepl, there is no info on the 4 DC names but there are DC's in AD that don't exist and weren't demoted? If that's correct then removing the gone DC's would be the next step, the ISTG may/should resolve the problem once the sites and DC's are valid. It could be/is likely more of a reporting problem related to the gone DC's rather than a real replication issue. – Ed Fries Jun 5 '15 at 20:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.