Question: I've got a Windows 2003 Active Directory infrastructure, and there are times (such as when terminating an employee) that I want instantaneous propagation across both of my AD servers. Currently, I make the change in both places, which I suspect is unhealthy, but it's the only way I know to make sure that the account is disabled to every machine. 

Is there a better way? Do I have to wait for the normal propagation time for convergence, or is there a way to "force" it?

Answer: 
Make the change to one domain controller. Then open up AD Sites and Services. Then drill down to each site, Servers, DC, NTDS Settings, then right-click each connection and choose *Replicate Now*.

Note: Each connection will tell you the *From Server* and *To Server* for the replication.

Note: Obviously, start the first replication *From* the DC you made the change on.

If you have a small domain, this shouldn't be too taxing a task. If you have a larger domain (more DCs) then you could script this.

To script, you need to use the CMD command called REPADMIN. For a full description of the command type *REPADMIN /?*. In short, you would use the command in a way similar to this:

```
REPADMIN /replicate DC1.yourdomain.loc DC2.yourdomain.loc dc=yourdomain,dc=loc /u:yourdomain\your_domain_admin_account

```

To find out the replication partnerships for a specific DC from the command line type the following:

```
REPADMIN /showrepl DC1.yourdomain.loc

```

Once you have figured out the right path/order to replicate to all your DCs, you can just dump all the commands into a batch file, and execute it when you need to replicate changes out quickly.
There 's also the possibility to make this using *repadmin.exe* with the /sync switch or you can even script it using *ReplicaSync* wich is included in the IADsTools. 

You might see [this](http://support.microsoft.com/?scid=kb;en-us;232072&x=11&y=10) kb article wich discuss the availables options.