question

arokira avatar image
0 Votes"
arokira asked arokira commented

Get-ADReplicationFailure doesn't return information about all the domain controllers

Dear community,

I have a relatively simple question to ask. I'm planning to use the cmdlet Get-ADReplicationFailure in a script to easily and rapidly collect information about Active Directory replication failures.

I have a few domain controllers spread in a couple of sites (main and branch). If I run the cmdlet on any DC in the main site, it returns its nice output (FailureCount is 0 by the way). If I run it on the DCs in the branch office, it returns nothing (no errors, it just goes back to the PowerShell prompt). If I run the cmdlet (either on the main or the branch site DCs) with the domain name for the -target parameter and the "Domain" value for the -scope parameter, it returns information related only to the main site DCs.

Just as an extra piece of information:

  • the replication is fine, with no errors or fails according "repadmin /replsum" or Active Directory replication tool or the DFS admin console, which instead return complete information about all the DCs in the domain (no errors)

  • I'm running the Get-ADReplicationFailure as domain admin

Am I missing something?

Thanks in advance for your help.

windows-server-powershellwindows-active-directory
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

RichMatheisen-8856 avatar image
0 Votes"
RichMatheisen-8856 answered

Are all DC's running a supported version of the O/S? And are they all running a 64-bit version of the O/S? Are you running the 64-bit version of PowerShell on all DC's?

The 32-bit PowerShell is found at C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, and the 64-bit PowerShell is at C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

A quick way to know if you're running in a 64- or 32 bit process in PowerShell is:

 [IntPtr]::size * 8
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

arokira avatar image
0 Votes"
arokira answered RichMatheisen-8856 commented

Hi RichMatheisen-8856,

Thanks for your reply. Just to be sure we are on the same page, what does "O/S" stand for? Sorry, it's the first time I see that acronym used with PowerShell, I first thought it would be "Operating System", but it doesn't feel right...

If this can help, all the DCs are running Windows Server 2019 (with the integrated PowerShell 5.1 desktop edition and the manually installed Powershell 7 core edition).

I'm ready to perform all the other tests as soon as I know what O/S means.

Looking forward to your feedback.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

"O/S" means Operating System. So you're correct.

It's important to know the environment before trying to figure out why things don't work. Mixing "bit-ness" between the operating system and a management tool like PowerShell can lead to all kinds of strange problems.

If "Get-ADReplicationFailure" is the only thing in the script, try adding the "-Verbose" switch to it. Also, even though it may not seem to make sense (because you're using a domain admin account), try the cmdlet from an elevated PowerShell session (i.e. start PowerShell with "Run as admin")

0 Votes 0 ·
arokira avatar image
0 Votes"
arokira answered RichMatheisen-8856 commented

Hi RichMatheisen-8856,

Sorry for the long break, I happened to take last week off. I performed the checks you suggested and this is the output on all the DCs:


147927-screen-shot-2021-11-09-at-111515-am.png




Now, this week the output for the command "Get-ADReplicationFailure -target 'mydomain' -scope Domain" (same if I use "Forest" as a scope) is returning all the DC's information but the PDC... So, surely it's not a problem with the PowerShell version or OS architecture (since two weeks ago I was able to get info only from the DCs in the main site, including the PDC).

I'm actually confused about how this cmdlet works and why it returns only some and not all DC's replication information: where's the caveat? is there something that, by design, excludes a DC from returning the related information? The Microsoft support article doesn't mention exceptions or particular situations where the information required with the cmdlet is intentionally omitted ( https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adreplicationfailure?view=windowsserver2019-ps )

Let me know if I can provide more information or perform more checks.


· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Does adding the -Verbose option to the Get-ADReplicationFailure cmdlet provide any useful information?

You might want to run this on each of your DCs and compare the output from each of them:

 (Get-ADForest).Domains | 
     ForEach-Object { 
         Get-ADDomainController -Discover -DomainName  $_ 
     } | 
         ForEach-Object { 
             Get-ADDomainController -server $_.Name -filter * 
         } | 
             Select-Object Name, Domain, Forest, IPv4Address, Site




0 Votes 0 ·
arokira avatar image
0 Votes"
arokira answered RichMatheisen-8856 edited

Here I am @RichMatheisen-8856 ,

Adding the -Verbose parameter to the cmdlet does not return anything extra, output is exactly the same.

I ran your snippet on each domain controller and the output is consistent on all of them: all the DCs are correctly listed with their name, domain name, forest name, IP address, and site name.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

You say that the output was exactly the same, so that hints at your running your code on the servers using Invoke-Command -Computer ... -- is that what you're doing? If so, keep in mind that only the "Success" stream is returned by the Invoke-Command unless you redirect the other stream(s).

The Verbose stream is identified by the number 4 so, if you're using Invoke-Command, add 4>&1 at the end of the cmdlet to redirect Verbose output to the Success stream (which is identified by the number 1).

0 Votes 0 ·
arokira avatar image
0 Votes"
arokira answered arokira commented

@RichMatheisen-8856
Nope, I'm not using the Invoke-Command cmdlet. I'm using the simple string "Get-ADReplicationFailure -target 'mydomain' -scope Domain -Verbose" alone and it returns information about almost all of the DCs in both my sites except one. And if I run the string "Get-ADReplicationFailure dc_name" on the very DC that is not returning information, I don't get any output there as well...

I followed the suggestion you gave me in your reply 8 days ago: "If "Get-ADReplicationFailure" is the only thing in the script, try adding the "-Verbose" switch to it."

Do you want me to use the Invoke-Command cmdlet instead?

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

After retiring I only have a single DC to work with . . . so I have no replication partners for my lonesome DC and no chance of reporting any replication failures, or of adding anything more of value to this thread. Running Get-ADReplicationFailure returns nothing here.

The one last thing I'd suggest is to check the replication partners on each of the DCs. The "repadmin" executable is useful here, as is the Get-ADReplicationPartnerMetadata.

0 Votes 0 ·
arokira avatar image arokira RichMatheisen-8856 ·

@RichMatheisen-8856 , thanks so much for your help all along. I guess I'll find a way to use repadmin and that other cmdlet to extract the information I need about AD replication.

It was worth double-checking with the community anyway.

I'll post my findings as soon as I succeed in my effort.

0 Votes 0 ·