Question: I've got a Windows 2003 Active Directory infrastructure, and there are times (such as when terminating an employee) that I want instantaneous propagation across both of my AD servers. Currently, I make the change in both places, which I suspect is unhealthy, but it's the only way I know to make sure that the account is disabled to every machine. 

Is there a better way? Do I have to wait for the normal propagation time for convergence, or is there a way to "force" it?

Answer: 
There is an even easier change. Just reset the users password. That is one of the few instant replications that AD performs. No need to run site replication

EDIT:

Small edit. It's not completely instant. What is does is forward the change in an out-of-band update. (It doesn't wait for normal replication cycles)

however, it's probably about as close to instant that you can get with AD.
[**Here's a Technet articl**](http://technet.microsoft.com/en-us/library/cc772726(WS.10).aspx#w2k3tr_repup_how_huzs)e that outlines the AD replication model. Look at the Urgent Replication section for a discussion of what gets replicated immediately and doesn't require a forced replication. Mostly it's critical user security events (password changes, account lockouts) that are replicated immediately. There are configuration considerations to be made to make this happen site to site.