We have this setup:

  • one server with Windows Server 2012 and Hyper-V that runs 2 WServer 2012 VM's, one of them is the primary domain controller which is working fine and other that runs SAP

  • one physical server that we use for other system, and as a secondary domain controller, which is NOT working well since the domain's administrator account password was changed.

The issue is that when we connect remotely to the secondary domain controller, it still accepts the old password, and not the new one. It also has an outdated version of AD users and and old version of the DNS server, it is like it has stopped updating itself from the primary domain controller.

This change was made by an old employee and he did not document it, so I don't really know what procedure he followed.

How can I make it updating again from the primary DC?


repadmin /showrepl should tell you whether you have a replication issue or not. If a password has not made it from one domain controller to another - this is the most likely cause

Unfortunately, replication in Active directory is an extremely complicated subject and there is a lot of things that we would need more information on including:

  • Site layout - are all the domain controllers on the same site?
  • DC OS & Functional Levels - what are the DC Operating systems, domain functional levels and forest functional levels?
  • FSMO Layout - are all the FSMO roles on one server or are they spanned?
  • DNS - is DNS replicating?
  • AD Replication Type - DFSR or FRS?

To start investigating this - there are a few places you can look:

  • Event Logs - have a look through the windows event logs and google and error codes relating to Active Directory, DNS, Replication etc. These may yield some results
  • Repadmin Report - have a look at the command listed above and see if it gives any error messages you can look up and fix

It may also be worth using the AD Replication Status Tool from Microsoft to allow you to look into where replication problems are happening and see if you can get any more information to work with. You can download the tool free from Microsoft here

  • repadmin /showrepl showed no errors in both DC's, but in the event viewer of the second DC, there are alot of instances of error 5774, big majority of them look like this: The dynamic registration of the DNS record '_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.MMPM.LAN.COM. 600 IN SRV 0 100 389 MMPMSV5.MMPM.LAN.COM.' failed on the following DNS server: DNS server IP address: Returned Response Code (RCODE): 5 Returned Status Code: 9017 is the ip adress of the primary DNS server. – Diego Alejandro Rosales Flores Dec 20 '17 at 20:45
  • I think the problem is that when the password was changed, it did not reach the second DC somehow, andy ideas in how to solve it? – Diego Alejandro Rosales Flores Dec 20 '17 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.