How to compare Active Directory on 2 Domain Controllers


Our Windows domain has 3 DCs. One of the DCs is replicating changes made on the other DCs but not replicating out any changes made on itself.

We have no idea which has the most up-to-date AD so we want to compare the other 2 with the 1 that isn't working.

Is it possible to export the properties on every object (OU, CN, User, Group etc.) so that I can compare them? Maybe to an xml file?

Maybe there is a PowerShell or vbScript that will do this?

Best Answer

It sounds like your plan is to determine what DC has the latest changes, and then make them on another DC?

No no no no no.

This will backfire. AD doesn't replicate by what changes are consistent with each other, it replicates by latest serial number. What you need to do is fix replication. Depending on your version of Windows (you didn't tell us; it would be helpful), you can use REPLMON or REPADMIN to determine what is failing, and probably why. Edit- cheekaleak is correct: DCDIAG is also useful for finding replication and other errors in your DCs.