Question: I've got a Windows 2003 Active Directory infrastructure, and there are times (such as when terminating an employee) that I want instantaneous propagation across both of my AD servers. Currently, I make the change in both places, which I suspect is unhealthy, but it's the only way I know to make sure that the account is disabled to every machine. 

Is there a better way? Do I have to wait for the normal propagation time for convergence, or is there a way to "force" it?

Answer: 
If you go into Active Directory Sites and Services, you can force replications. Open the Server object and click on the NTDS Settings. This will give you a list of their replication partners for GC data as well as regular DC-DC traffic. As I understand it, you can force replication by going to each of the connections, right-clicking on it, and choosing "Replicate Now".
[![alt text](https://i.stack.imgur.com/kuvC4.png)](https://i.stack.imgur.com/kuvC4.png)  

(source: [sysadmin1138.net](http://sysadmin1138.net/images/replicate-now.png))
Remember when you play with forcing replication, all replication links are **one-way, incoming**. If you want to *push* changes outbound from a DC via the Sites & Services console, you have to go to each replica-partner and ***PULL*** from the source DC.

There is an easier way to force "outbound-full-replication" using the [repadmin.exe](http://technet.microsoft.com/en-us/library/cc755360(WS.10).aspx?ppud=4) tool from the [Windows 2003 SP1 Support Tools](http://support.microsoft.com/kb/892777) kit:

```
repadmin /syncall /P /e sourceDC1.domain.local

```

This will push the changes via all replication links, outward from your source DC, for the default naming contaxt (which is where your user data is).