Repadmin

Applies To: Windows Server 2003, Windows Server 2008, Windows Server 2003 R2, Windows Server 2008 R2, Windows Server 2012, Windows Server 2003 with SP1, Windows 8

Repadmin.exe helps administrators diagnose Active Directory replication problems between domain controllers running Microsoft Windows operating systems.

Repadmin.exe is built into Windows Server 2008 and Windows Server 2008 R2. It is available if you have the AD DS or the AD LDS server role installed. It is also available if you install the Active Directory Domain Services Tools that are part of the Remote Server Administration Tools (RSAT). For more information, see How to Administer Microsoft Windows Client and Server Computers Locally and Remotely (https://go.microsoft.com/fwlink/?LinkID=177813).

To use Repadmin.exe, you must run the ntdsutil command from an elevated command prompt. To open an elevated command prompt, click Start, right-click Command Prompt, and then click Run as administrator.

You can use Repadmin.exe to view the replication topology, as seen from the perspective of each domain controller. In addition, you can use Repadmin.exe to manually create the replication topology, to force replication events between domain controllers, and to view both the replication metadata and up-to-dateness vectors (UTDVECs). You can also use Repadmin.exe to monitor the relative health of an Active Directory Domain Services (AD DS) forest.

Repadmin also requires administrative credentials on each domain controller that is targeted by the command. Members of the Domain Admins group have the sufficient permissions to run repadmin on domain controllers in that domain. Members of the Enterprise Admins group are, by default, granted membership in the Domain Admins group in each domain in the forest.

You can also delegate the specific permissions that are required to view and manage replication status.

For more information about how to run repadmin.exe commands in different troubleshooting scenarios and how to interpret the output, see Monitoring and Troubleshooting Active Directory Replication Using Repadmin (https://go.microsoft.com/fwlink/?LinkId=197165). For more information about using repadmin.exe to remove lingering objects, see Use Repadmin to Remove Lingering Objects(https://go.microsoft.com/fwlink/?LinkId=197166).

Syntax

repadmin <cmd> <args> [/u:{domain\user}] [/pw:{password | *}] [/retry[:<retries>][:<delay>]] [/csv]

Help commands

Repadmin provides different Help menus for different types of information and for different levels of experience among administrators. The following table shows the commands that you can run for different Help menus in Repadmin.

Command	Description
/?	Displays and describes commands that are available.
/help	Same as /?
/?:<cmd>	Displays possible arguments <args>, appropriate syntaxes, and examples for the specified command <cmd>.
/help:<cmd>	Same as /?:<cmd>
/experthelp	Displays commands that are available for advanced users only.
/listhelp	Displays the variations of syntax that are available for the DSA_NAME, DSA_LIST, NCNAME and OBJ_LIST strings. Note The DSA_LIST parameter is the same as the DC_LIST parameter in the Windows Server 2003 version of Repadmin.exe.
/oldhelp	Displays help for commands in the Windows 2000 Server and Windows Server 2003 versions of Repadmin.exe.

Commands

Additional parameters

The DSA_LIST parameter

This section explains the syntax of the DSA_LIST parameter.

Syntax

{<dc_name> | * |<partial_server_name>* | site:<site_name> |gc: |fsmo_<type>:[<name> | <site_name>]}

Parameters

Valid operations master roles

Remarks

• Repadmin syntax uses the following terminology:

  • Naming context

    The distinguished name of a directory partition in an AD DS forest. Naming contexts include the three Read/Write naming contexts—domain, schema, and configuration—and the optional read-only naming contexts that are present on domain controllers that are global catalog servers. A naming context can also be an application directory partition. You specify a naming context as a distinguished name, which indicates its hierarchical relationship to the forest root domain, for example, DC=MyDomain,DC=Contoso,DC=Com.

  • Globally unique identifier (GUID)

    The 128-bit number that is used to uniquely identify objects that are stored in the directory, for example, fa1a9e6e-2e14-11d2-aa9b-bbfc0a30094c. The GUID is sometimes referred to in syntax as a universally unique identifier (UUID). For the purposes of Repadmin, these two terms are synonymous.

  • Distinguished name

    An X.500 distinguished name, for example, CN=Server1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=Contoso,DC=Com.

• In the Repadmin examples that are included in each command topic, the domain controller object GUID and the domain controller Invocation ID that are returned by some commands, such as the /showrepl command, initially show identical hexadecimal values (until system state is restored). However, these two values identify different objects. The domain controller object GUID is a unique identifier for the NTDS Settings object on the domain controller. The value of the domain controller object GUID does not change unless you remove AD DS from the domain controller, and then reinstall it. The domain controller Invocation ID identifies the directory database on the domain controller. This value changes when you restore a domain controller from a backup. When you first install a domain controller, the values for these two identifiers are the same; however, whenever you restore a domain controller from a backup, the Invocation ID value changes.

• Most Repadmin commands take their parameters in the following order:

  1. "Destination or Target DSA_LIST"

  2. "Source DSA_NAME", if required

  3. <Naming Context> or Object distinguished name, if required

  For example:

  repadmin /showrepl <DSA_LIST> <Source_DSA_NAME> <Naming Context>
  

  <DSA_NAME> is a Directory Service Agent binding string, as is <DSA_LIST>. For AD DS, this string is a network label. For a domain controller, network labels include Domain Name System (DNS), NetBIOS, and IP address. For example:

  dc-01
  dc-01.contoso.com
  localhost
  

  For Active Directory Lightweight Directory Services (AD LDS), this string must be a network label of the AD LDS server that is followed by a colon, and then followed by the Lightweight Directory Access Protocol (LDAP) port of the AD LDS instance. For example:

  ad-am-01:2000
  ad-am-01.contoso.com:2000
  

  <Naming Context> is the distinguished name of the root of the naming context. For example:

  DC=My-Domain,DC=Contoso,DC=Com
  

• Text with international or Unicode characters displays correctly if you install appropriate fonts and language support on the computer from which you run Repadmin. Examples of such text are naming context names and server names.

Additional references

Command-Line Syntax Key