Question: I've got a Windows 2003 Active Directory infrastructure, and there are times (such as when terminating an employee) that I want instantaneous propagation across both of my AD servers. Currently, I make the change in both places, which I suspect is unhealthy, but it's the only way I know to make sure that the account is disabled to every machine. 

Is there a better way? Do I have to wait for the normal propagation time for convergence, or is there a way to "force" it?

Answer: 
There is an even easier change. Just reset the users password. That is one of the few instant replications that AD performs. No need to run site replication

EDIT:

Small edit. It's not completely instant. What is does is forward the change in an out-of-band update. (It doesn't wait for normal replication cycles)

however, it's probably about as close to instant that you can get with AD.
Make the change to one domain controller. Then open up AD Sites and Services. Then drill down to each site, Servers, DC, NTDS Settings, then right-click each connection and choose *Replicate Now*.

Note: Each connection will tell you the *From Server* and *To Server* for the replication.

Note: Obviously, start the first replication *From* the DC you made the change on.

If you have a small domain, this shouldn't be too taxing a task. If you have a larger domain (more DCs) then you could script this.

To script, you need to use the CMD command called REPADMIN. For a full description of the command type *REPADMIN /?*. In short, you would use the command in a way similar to this:

```
REPADMIN /replicate DC1.yourdomain.loc DC2.yourdomain.loc dc=yourdomain,dc=loc /u:yourdomain\your_domain_admin_account

```

To find out the replication partnerships for a specific DC from the command line type the following:

```
REPADMIN /showrepl DC1.yourdomain.loc

```

Once you have figured out the right path/order to replicate to all your DCs, you can just dump all the commands into a batch file, and execute it when you need to replicate changes out quickly.