Question: I've got a Windows 2003 Active Directory infrastructure, and there are times (such as when terminating an employee) that I want instantaneous propagation across both of my AD servers. Currently, I make the change in both places, which I suspect is unhealthy, but it's the only way I know to make sure that the account is disabled to every machine. 

Is there a better way? Do I have to wait for the normal propagation time for convergence, or is there a way to "force" it?

Answer: 
Remember when you play with forcing replication, all replication links are **one-way, incoming**. If you want to *push* changes outbound from a DC via the Sites & Services console, you have to go to each replica-partner and ***PULL*** from the source DC.

There is an easier way to force "outbound-full-replication" using the [repadmin.exe](http://technet.microsoft.com/en-us/library/cc755360(WS.10).aspx?ppud=4) tool from the [Windows 2003 SP1 Support Tools](http://support.microsoft.com/kb/892777) kit:

```
repadmin /syncall /P /e sourceDC1.domain.local

```

This will push the changes via all replication links, outward from your source DC, for the default naming contaxt (which is where your user data is).
There 's also the possibility to make this using *repadmin.exe* with the /sync switch or you can even script it using *ReplicaSync* wich is included in the IADsTools. 

You might see [this](http://support.microsoft.com/?scid=kb;en-us;232072&x=11&y=10) kb article wich discuss the availables options.