Question: I've got a Windows 2003 Active Directory infrastructure, and there are times (such as when terminating an employee) that I want instantaneous propagation across both of my AD servers. Currently, I make the change in both places, which I suspect is unhealthy, but it's the only way I know to make sure that the account is disabled to every machine. 

Is there a better way? Do I have to wait for the normal propagation time for convergence, or is there a way to "force" it?

Answer: 
If you go into Active Directory Sites and Services, you can force replications. Open the Server object and click on the NTDS Settings. This will give you a list of their replication partners for GC data as well as regular DC-DC traffic. As I understand it, you can force replication by going to each of the connections, right-clicking on it, and choosing "Replicate Now".
[![alt text](https://i.stack.imgur.com/kuvC4.png)](https://i.stack.imgur.com/kuvC4.png)  

(source: [sysadmin1138.net](http://sysadmin1138.net/images/replicate-now.png))
[**Here's a Technet articl**](http://technet.microsoft.com/en-us/library/cc772726(WS.10).aspx#w2k3tr_repup_how_huzs)e that outlines the AD replication model. Look at the Urgent Replication section for a discussion of what gets replicated immediately and doesn't require a forced replication. Mostly it's critical user security events (password changes, account lockouts) that are replicated immediately. There are configuration considerations to be made to make this happen site to site.