Question: I've got a Windows 2003 Active Directory infrastructure, and there are times (such as when terminating an employee) that I want instantaneous propagation across both of my AD servers. Currently, I make the change in both places, which I suspect is unhealthy, but it's the only way I know to make sure that the account is disabled to every machine. 

Is there a better way? Do I have to wait for the normal propagation time for convergence, or is there a way to "force" it?

Answer: 
There is an even easier change. Just reset the users password. That is one of the few instant replications that AD performs. No need to run site replication

EDIT:

Small edit. It's not completely instant. What is does is forward the change in an out-of-band update. (It doesn't wait for normal replication cycles)

however, it's probably about as close to instant that you can get with AD.
There 's also the possibility to make this using *repadmin.exe* with the /sync switch or you can even script it using *ReplicaSync* wich is included in the IADsTools. 

You might see [this](http://support.microsoft.com/?scid=kb;en-us;232072&x=11&y=10) kb article wich discuss the availables options.