Active Directory / Intermediate / Lesson 9

Replication, partitions, and operation masters

Reason about replicated naming contexts and specialized operation roles without treating every controller as one master copy or forcing synchronization.

About 5 min readContent reviewed 2026-10-26

On this page

Lesson goals

Distinguish schema, configuration, domain, and application partitions.
Explain multi-master updates, convergence, and specialized FSMO roles.
Interpret sanitized replication snapshots with explicit limitations.

A controller does not host every writable object in the forest

AD DS replicates directory partitions according to their scope. Schema and configuration are forest-wide foundations, domain data belongs to its domain, and application partitions can serve particular replicated data such as DNS. A global catalog provides forest search information with partial replicas for other domains rather than a full writable copy of every domain. Read-only domain controllers have additional restrictions and credential-caching policy; they are not ordinary writable peers for every operation. Identify the affected naming context and controller role before judging a discrepancy. A healthy replica of one partition does not prove another partition or SYSVOL is healthy.

Compare one modeled attribute at a declared observation time

The complete Python fixture contains three synthetic replica observations of one logical object version. It reports which controller label differs from the chosen expected version. These counters are model labels, not comparable raw USNs from different real DCs. Real replication uses metadata and mechanisms that cannot be reduced to comparing one local sequence number across servers. A difference may reflect normal convergence, a failed path, conflict, deletion state, or an invalid comparison. The model detects its own declared mismatch only; it does not prove replication failure, choose an authoritative controller, or authorize a synchronization action.

python Offline logical-version mismatch model

expected_object_version = 4
observations = {"dc-a": 4, "dc-b": 4, "dc-c": 3}
mismatches = sorted(dc for dc, version in observations.items() if version != expected_object_version)
print(mismatches)
print(len(mismatches))

Expected output

['dc-c']
1

The model prints dc-c and one mismatch. It does not read replication metadata or compare actual DC-local sequence numbers.

FSMO roles are specific responsibilities, not all-purpose masters

Most supported directory changes use writable multi-master replication, while five operation-master roles handle specialized responsibilities. Schema master and domain naming master are forest roles; RID master, PDC emulator, and infrastructure master are domain roles. A role holder is not the only controller that can authenticate users or answer ordinary reads. Role loss has consequences that depend on the role and operation. Transferring a role and seizing a role are different operational decisions with different recovery requirements. This course performs neither and never recommends seizure merely because one replication observation is old. Identify the required operation before attributing every symptom to FSMO.

Record source, destination, partition, and time

The contextual record identifies the intended relationship and the kind of sanitized evidence required. It is not a connection object, command, or repair plan. Real analysis also needs last-success history, status categories, topology context, DNS, connectivity, time, and authentication dependencies. A failed inbound connection is directional; the reverse observation can differ. The KCC builds topology based on directory configuration, but that does not override a broken network or security policy. Do not treat a manual extra connection as the first universal fix. Preserve observations before changing the topology so the cause is not erased by speculative actions.

json Non-runnable replication evidence record

{"source":"dc-a","destination":"dc-c","partition":"domain:ad.example.test","observation_time":"synthetic-t2","required_evidence":["last_success","status_category","topology","dependencies"],"action":"none"}

The record names a directional observation and no action. It initiates no replication, topology change, or role operation.

Separate ordinary convergence from recovery decisions

A recent write can legitimately appear at one replica before another, but repeated failures or excessive lag need bounded diagnosis against the expected site design. Deletions, retained objects, unsupported restore history, and stale controllers require particular care. Do not reconnect an old restored controller or force replication as a classroom experiment. A backup and a replica solve different problems: replication can distribute an unwanted change, while recovery must identify a trustworthy state. Keep the evidence and escalation boundary explicit. Later recovery lessons use offline planning models only and do not provide an improvised forest-restoration procedure.

Common errors and fixes

A global catalog is assumed writable for every domain.

Why it happens: Forest search replicas were confused with full domain replicas.
How to fix it: Identify the naming context and replica type.
Prevent it next time: Include partition scope in every replication diagram.

Raw local USNs are compared as a universal cross-DC version.

Why it happens: Controller-local metadata was treated as a shared scalar clock.
How to fix it: Use the documented replication metadata and authorized interpretation.
Prevent it next time: Keep teaching counters labeled as model-only values.

A stale observation triggers a role seizure proposal.

Why it happens: Ordinary replication diagnosis was confused with specialized recovery.
How to fix it: Establish the failing partition and dependency before escalation.
Prevent it next time: Use a separate approved recovery runbook for role emergencies.

Check your understanding

1. Update dc-c to model version four. What does the empty mismatch list prove, and what remains untested?

Show worked solution

All three declared observations equal the model’s chosen version, so the list is empty and count zero. Actual object metadata, other attributes, partitions, topology, deletion state, SYSVOL, and live connectivity remain untested. Do not call the forest healthy from this scalar model. State the exact object/version assertion and obtain separate authorized evidence for the required service outcome.

2. A controller loses the domain naming master role holder but ordinary reads still work. Explain why this is not a contradiction.