Diagnosing AD LDS replication errors

Question

We have an active directory lightweight directory services instance that supports an external‑facing application. Recently, replication errors started appearing between two replicas in the same configuration set. Unlike standard active directory domain services, it uses different diagnostic tools and logging mechanisms, so the usual replication troubleshooting steps don’t fully apply here. The replication metadata and event logs show inconsistencies, and attempts to force synchronization have not resolved the issue. Because it relies on its own replication engine, we suspect either configuration set misalignment or schema replication problems.

Answer 1

Hi Farid Ali,

Regarding your AD LDS replication issue, I want to clarify an architectural detail to help us resolve this quickly.

You mentioned that AD LDS uses different diagnostic tools. In fact, AD LDS uses the exact same replication engine (Knowledge Consistency Checker - KCC) and command-line tools (like repadmin) as standard AD DS. The reason standard troubleshooting steps appear to fail is simply because AD LDS runs on custom ports (unlike AD DS, which defaults to port 389). If you run a standard repadmin command without specifying the port, it will fail to bind to the AD LDS instance.

To accurately diagnose the inconsistencies, we just need to append the AD LDS port to our standard commands.

Recommended Action Plan:

Please perform the following steps on one of the affected AD LDS servers:

1. Gather the Replication Status

Open an elevated Command Prompt and run the following command to extract the exact replication errors. (Replace 50000 with the actual LDAP port your AD LDS instance is using):

• repadmin /showrepl localhost:50000 /csv > C:\temp\LDS_repl_status.csv

The resulting CSV will reveal the error codes.

2. Force Synchronization (Correct Syntax)

To force replication across the configuration set using the correct port routing, run:

• repadmin /syncall localhost:50000 /e /A /d

3. Verify Service Account Permissions

Unlike standard AD DS (which replicates using the physical Computer Account), AD LDS replicates using the Service Account assigned to the AD LDS service (services.msc). Please ensure that the Service Account on Replica A is not locked out, has its password synced, and possesses the necessary permissions to communicate with Replica B.

========================

I hope this helps address your query! If this works for you, please consider hitting "Accept Answer" so other users facing this issue can easily find the solution as a reference.