AD Replication Is Failing and repadmin Won't Say Anything Useful

The error: Domain controllers stop syncing changes with each other. Symptoms are indirect — group membership changes don't show up on some DCs, password changes work at one site but not another. repadmin /showrepl often just shows a stale last-success timestamp with no clear error.

Environment: Any multi-DC Active Directory environment, Windows Server 2016 and later.

Why this happens: AD replication depends on DNS, Kerberos, and RPC all working correctly between DCs — and a failure in any one of those three shows up as "replication just isn't happening," not as a clear error pointing at the actual layer that's broken. The single most common root cause is DNS: a DC that can't resolve another DC's SRV records can't replicate with it, but the resulting error message rarely says "DNS" directly.

The fix:

1. Run repadmin /replsummary across all DCs to see the actual scope — one DC isolated, or several.
2. Check DNS first, specifically: nslookup -type=srv _ldap._tcp.dc._msdcs.yourdomain.com from the affected DC, confirming every DC resolves correctly.
3. Check time sync — Kerberos fails silently if DCs drift more than 5 minutes apart. w32tm /query /status on each DC.
4. Check the actual replication error detail: repadmin /showrepl * /csv exported and reviewed in Excel is far more readable than the console output.
5. Force a sync test once DNS/time are confirmed good: repadmin /syncall /A /e /P.

One thing worth knowing: people chase Group Policy or permissions problems for hours when the actual cause was DNS the whole time. Rule out DNS first, always, before touching anything AD-specific.