Enterprise-grade Active Directory replication management tool
Audit β’ Repair β’ Verify β’ Monitor β’ Auto-Heal
Quick Start β’ Documentation β’ Migration Guide β’ API Reference
Click to expand
AD Replication Manager is a consolidated, production-ready PowerShell tool that replaces legacy AD-Repl-Audit.ps1 and AD-ReplicationRepair.ps1 scripts with a single, safer, faster, and more maintainable solution.
| Challenge | Solution |
|---|---|
| π΄ Two overlapping scripts (3,177 lines) | β Single unified script (900 lines) - 72% reduction |
π΄ 90 Write-Host calls blocking pipelines |
β 100% pipeline-friendly streams |
| π΄ No WhatIf/Confirm support | β
Full ShouldProcess implementation |
| π΄ Serial processing only | β Parallel processing - 83% faster |
| π΄ No CI/CD integration | β JSON output + stable exit codes |
|
|
|
|
|
|
NEW in v3.3.0: Intelligent caching that only checks DCs with previous issues!
# First run: Full scan (establishes baseline)
.\Invoke-ADReplicationManager.ps1 -Mode Audit -Scope Forest
# Subsequent runs: Delta mode (40-80% faster!)
.\Invoke-ADReplicationManager.ps1 -Mode Audit -Scope Forest -DeltaModePerformance Impact:
- 94% faster in 100-DC environment with 5 issues
- 87% faster in 200-DC environment with 20 issues
- Perfect for hourly monitoring - minimal overhead
How It Works:
- Caches DCs with issues from previous run
- Skips healthy DCs on next run
- Automatic full scans when cache expires (60 min default)
- Force full scan option always available
Key Features:
- β Intelligent caching - JSON-based delta cache
- β Configurable thresholds - 1-1440 minutes
- β Safety controls - Automatic full scans when needed
- β Performance tracking - DCs skipped, % reduction
- β Flexible - Force full scan option
Combine with Auto-Healing & Fast Mode:
.\Invoke-ADReplicationManager.ps1 `
-Mode Repair `
-DeltaMode `
-AutoHeal `
-FastMode
# Up to 95% total performance improvement!Full Delta Mode Documentation β
NEW in v3.2.0: Policy-based automated healing that fixes issues while you sleep!
.\Invoke-ADReplicationManager.ps1 `
-Mode Repair `
-AutoHeal `
-HealingPolicy Conservative `
-EnableRollback `
-SlackWebhook "https://hooks.slack.com/..."Three Healing Policies:
- Conservative (Production-safe): Only stale replication, 30-min cooldown
- Moderate (Balanced): Stale + failures, 15-min cooldown
- Aggressive (Maximum automation): All issues, 5-min cooldown
Key Features:
- β Intelligent eligibility checks - Category, severity, cooldown
- β Rollback capability - Automatic rollback on failures
- β Complete audit trail - CSV + JSON history
- β Safety controls - Cooldowns prevent healing loops
- β Statistics tracking - Success rates, trends, top DCs
Full Auto-Healing Documentation β
.\Invoke-ADReplicationManager.ps1 `
-Mode Audit `
-Scope Forest `
-SlackWebhook "https://..." `
-TeamsWebhook "https://..."Get instant alerts with rich formatting, emojis, and actionable data directly in your team channels! |
.\Invoke-ADReplicationManager.ps1 `
-CreateScheduledTask `
-TaskSchedule Daily `
-EmailTo "admin@company.com"One command to create a fully automated monitoring task - no manual configuration needed! |
.\Invoke-ADReplicationManager.ps1 `
-Mode Audit `
-EnableHealthScore `
-HealthHistoryPath "C:\Reports"0-100 score with letter grades (A-F) + historical CSV tracking for trend analysis! |
- Proactive Monitoring - Get notified before users complain
- Zero Config - Automated task setup in seconds
- Trend Analysis - Track AD health over time (daily/weekly/monthly)
- Team Collaboration - Share alerts in Slack/Teams channels
- Email Alerts - Optional SMTP notifications with severity-based sending
1. Quality Improvements
Write-Host "Running repadmin..." -ForegroundColor Gray # Not pipeline-friendly
exit 1 # Terminates hostWrite-Verbose "Running repadmin on $dc" # Pipeline-friendly
Write-Warning "Issues detected: $count"
$Script:ExitCode = 2 # Graceful exitImprovements:
- β
90
Write-Hostβ 0 (100% elimination) - β Pipeline-friendly streams
- β Comprehensive parameter validation
- β Proper error handling
2. Security Enhancements
& repadmin /syncall $dc # Runs without confirmationif ($PSCmdlet.ShouldProcess($dc, "Force replication sync")) {
& repadmin /syncall /A /P /e $dc 2>&1
if ($LASTEXITCODE -ne 0) { throw "Sync failed: $LASTEXITCODE" }
}Security Features:
- β Every action requires confirmation
- β Scope controls prevent accidents
- β Tamper-evident audit trail
- β Targeted error handling
3. Consolidation
Unified Architecture:
βββββββββββββββββββββββββββββββββββββββββββββββ
β Invoke-ADReplicationManager.ps1 β
βββββββββββββββββββββββββββββββββββββββββββββββ€
β ββ Get-ReplicationSnapshot β Data β
β ββ Find-ReplicationIssues β Analysis β
β ββ Invoke-ReplicationFix β Repairs β
β ββ Test-ReplicationHealth β Validation β
β ββ Export-ReplReports β Outputs β
β ββ Write-RunSummary β Guidance β
βββββββββββββββββββββββββββββββββββββββββββββββ
- β Single script vs 2 overlapping files
- β 8 unified functions vs 20 duplicated
- β Clean separation of concerns
- β Zero code duplication
4. Performance Gains
$DomainControllers | ForEach-Object -Parallel {
$snapshot = Get-ReplicationSnapshot -DC $_
} -ThrottleLimit $Throttle| Environment | v2.0 Time | v3.0 Time | Improvement |
|---|---|---|---|
| 10 DCs | 5m 20s | 1m 05s | 80% faster β‘ |
| 24 DCs | 12m 30s | 1m 45s | 86% faster β‘ |
| 50 DCs | 28m 15s | 2m 50s | 90% faster β‘ |
Tested on PowerShell 7.4, mixed on-prem/Azure
5. Enhanced Reporting
{
"ExecutionTime": "00:01:45",
"Mode": "AuditRepairVerify",
"TotalDCs": 24,
"HealthyDCs": 22,
"DegradedDCs": 2,
"UnreachableDCs": 0,
"IssuesFound": 5,
"ActionsPerformed": 5,
"ExitCode": 0
}ReplicationSnapshot.csv- Current stateIdentifiedIssues.csv- All detected issuesRepairActions.csv- Actions takenVerificationResults.csv- Post-repair health
| Code | Meaning | Action |
|---|---|---|
0 |
β Healthy / Repaired | Success |
2 |
Review logs | |
3 |
π΄ DC Unreachable | Check connectivity |
4 |
β Fatal Error | Review error log |
.\Invoke-ADReplicationManager.ps1 -Mode Audit -DomainControllers DC01,DC02 -VerboseNo modifications. Safe to run in production. Use
-Verboseto see detailed progress.
.\Invoke-ADReplicationManager.ps1 -Mode Repair -Scope Site:Default-First-Site-Name -WhatIfShows what would happen without executing. Perfect for testing.
.\Invoke-ADReplicationManager.ps1 -Mode Repair -DomainControllers DC01,DC02 -AuditTrailPrompts for confirmation. Full transcript logging. Best for manual operations.
.\Invoke-ADReplicationManager.ps1 `
-Mode AuditRepairVerify `
-Scope Site:HQ `
-AutoRepair `
-AuditTrail `
-OutputPath C:\Reports\AD-HealthComplete audit β repair β verify cycle. No prompts. Compliance-ready logging.
- PowerShell: 5.1+ (Windows PowerShell) or 7+ (PowerShell Core)
- Module: ActiveDirectory
- Permissions: Domain Admin or Replication Management rights
- Network: Ports 135, 445, dynamic RPC to all DCs
Windows Server:
Install-WindowsFeature RSAT-AD-PowerShellWindows 10/11:
# Install RSAT via Settings β Apps β Optional Features β RSAT: Active Directory
# Or use:
Get-WindowsCapability -Online | Where-Object Name -like "Rsat.ActiveDirectory*" |
Add-WindowsCapability -Online# Clone repository
git clone https://github.com/adrian207/Repl.git
cd Repl
# Or download directly
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/adrian207/Repl/main/Invoke-ADReplicationManager.ps1" `
-OutFile "Invoke-ADReplicationManager.ps1"# Run test suite
.\Test-ADReplManager.ps1 -TestDCs "DC01","DC02"Example 1: Audit Specific DCs
.\Invoke-ADReplicationManager.ps1 `
-Mode Audit `
-DomainControllers DC01,DC02,DC03 `
-Verbose `
-OutputPath C:\Reports\AD-AuditOutput:
VERBOSE: Resolving scope: DCList
VERBOSE: Target DCs: DC01, DC02, DC03
VERBOSE: Getting replication snapshot for DC01...
INFORMATION: Healthy DCs: 3, Degraded: 0, Unreachable: 0
INFORMATION: Reports saved to C:\Reports\AD-Audit\ADRepl-20251018-143052
Example 2: Forest-Wide Audit
.\Invoke-ADReplicationManager.ps1 `
-Mode Audit `
-Scope Forest `
-Throttle 16 `
-ConfirmPrompts:
Confirm
Are you sure you want to perform this action?
Performing the operation "Process all DCs in forest" on target "24 domain controllers".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"):
Example 3: Site-Specific Repair
.\Invoke-ADReplicationManager.ps1 `
-Mode Repair `
-Scope Site:HQ `
-AuditTrail `
-OutputPath C:\Reports\AD-RepairsPrompts for each action:
Confirm
Are you sure you want to perform this action?
Performing the operation "Force replication sync" on target "DC01".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"):
Example 4: Scheduled Task (Fully Automated)
PowerShell Script:
# C:\Scripts\AD-HealthCheck.ps1
$ErrorActionPreference = 'Stop'
.\Invoke-ADReplicationManager.ps1 `
-Mode AuditRepairVerify `
-Scope Site:Production `
-AutoRepair `
-AuditTrail `
-OutputPath C:\Reports\AD-Health `
-Throttle 8
# Parse results
$summary = Get-Content C:\Reports\AD-Health\ADRepl-*\summary.json -Raw | ConvertFrom-Json
# Email alert on issues
if ($summary.ExitCode -ne 0) {
$body = @"
AD Replication Health Check Alert
Exit Code: $($summary.ExitCode)
Total DCs: $($summary.TotalDCs)
Healthy: $($summary.HealthyDCs)
Degraded: $($summary.DegradedDCs)
Unreachable: $($summary.UnreachableDCs)
Issues Found: $($summary.IssuesFound)
Actions Performed: $($summary.ActionsPerformed)
Review logs at C:\Reports\AD-Health
"@
Send-MailMessage -To "ad-admins@company.com" -Subject "AD Replication Alert" -Body $body
}
exit $summary.ExitCodeScheduled Task:
$action = New-ScheduledTaskAction -Execute "pwsh.exe" `
-Argument "-File C:\Scripts\AD-HealthCheck.ps1"
$trigger = New-ScheduledTaskTrigger -Daily -At "2:00 AM"
$principal = New-ScheduledTaskPrincipal -UserID "DOMAIN\SVC-ADHealth" `
-LogonType Password -RunLevel Highest
Register-ScheduledTask -TaskName "AD Replication Health Check" `
-Action $action -Trigger $trigger -Principal $principalExample 5: CI/CD Integration
# Azure DevOps / GitHub Actions / Jenkins
.\Invoke-ADReplicationManager.ps1 `
-Mode Audit `
-Scope Site:Production `
-OutputPath $env:BUILD_ARTIFACTSTAGINGDIRECTORY
# Parse results
$summary = Get-Content "$env:BUILD_ARTIFACTSTAGINGDIRECTORY\ADRepl-*\summary.json" |
ConvertFrom-Json
# Set pipeline variables
Write-Host "##vso[task.setvariable variable=ADHealthCode]$($summary.ExitCode)"
Write-Host "##vso[task.setvariable variable=ADHealthyDCs]$($summary.HealthyDCs)"
Write-Host "##vso[task.setvariable variable=ADDegradedDCs]$($summary.DegradedDCs)"
# Fail pipeline if critical
if ($summary.ExitCode -eq 3 -or $summary.ExitCode -eq 4) {
Write-Host "##vso[task.logissue type=error]AD health check failed with exit code $($summary.ExitCode)"
exit $summary.ExitCode
}
# Warning if degraded
if ($summary.DegradedDCs -gt 0) {
Write-Host "##vso[task.logissue type=warning]$($summary.DegradedDCs) DCs degraded"
}Example 6: Parallel Processing (PS7)
# Install PowerShell 7 for best performance
# https://aka.ms/powershell-release?tag=stable
pwsh -File .\Invoke-ADReplicationManager.ps1 `
-Mode Audit `
-Scope Forest `
-Throttle 16 `
-VerbosePerformance Comparison:
PowerShell 5.1 (Serial): 24 DCs in 12m 30s
PowerShell 7.4 (Parallel): 24 DCs in 1m 45s β 86% faster!
| Parameter | Type | Default | Description |
|---|---|---|---|
-Mode |
String | Audit |
Operation mode: β’ Audit - Read-only health checkβ’ Repair - Fix detected issuesβ’ Verify - Validate replication healthβ’ AuditRepairVerify - Full workflow |
-Scope |
String | DCList |
Target scope: β’ Forest - All DCs (requires confirmation)β’ Site:<Name> - Specific AD siteβ’ DCList - Explicit list (requires -DomainControllers) |
-DomainControllers |
String[] | @() |
Explicit DC list (e.g., DC01,DC02,DC03) |
-DomainName |
String | Current domain | Target domain FQDN |
| Parameter | Type | Default | Description |
|---|---|---|---|
-AutoRepair |
Switch | $false |
Skip confirmation prompts (use with caution!) |
-Throttle |
Int | 8 |
Max parallel operations (1-32, PS7+ only) |
-Timeout |
Int | 300 |
Per-DC timeout in seconds (60-3600) |
| Parameter | Type | Default | Description |
|---|---|---|---|
-OutputPath |
String | .\ADRepl-<timestamp> |
Report directory |
-AuditTrail |
Switch | $false |
Enable transcript logging (compliance) |
-Verbose- Show detailed progress-WhatIf- Preview actions without executing-Confirm- Prompt for each action-InformationAction Continue- Show informational messages
| Code | Status | Description | CI/CD Action |
|---|---|---|---|
| 0 | β Success | All DCs healthy OR successfully repaired | β Pass |
| 2 | Problems detected but not fixed | ||
| 3 | π΄ Unreachable | One or more DCs unavailable | π΄ Alert |
| 4 | β Fatal Error | Unexpected error during execution | π΄ Fail |
.\Invoke-ADReplicationManager.ps1 -Mode Audit -DomainControllers DC01,DC02
$exitCode = $LASTEXITCODE
switch ($exitCode) {
0 { Write-Host "β
All systems healthy" -ForegroundColor Green }
2 { Write-Warning "β οΈ Issues detected - review logs" }
3 { Write-Error "π΄ DCs unreachable - check connectivity" }
4 { Write-Error "β Fatal error - review error log" }
}
exit $exitCodeEnvironment: 24 DCs (Mixed on-prem/Azure), PowerShell 7.4
| Mode | v2.0 (Serial) | v3.0 (Parallel) | Improvement |
|---|---|---|---|
| Audit Only | 12m 30s | 1m 45s | 86% faster β‘ |
| Repair Mode | 18m 15s | 2m 50s | 84% faster β‘ |
| Full Workflow | 25m 45s | 4m 20s | 83% faster β‘ |
| DC Count | PS 5.1 (Serial) | PS 7+ (Parallel) | Speedup |
|---|---|---|---|
| 5 DCs | 2m 30s | 35s | 4.3x |
| 10 DCs | 5m 20s | 1m 05s | 4.9x |
| 25 DCs | 13m 45s | 1m 55s | 7.2x |
| 50 DCs | 28m 15s | 2m 50s | 10.0x |
# For large forests (50+ DCs)
.\Invoke-ADReplicationManager.ps1 `
-Mode Audit `
-Scope Forest `
-Throttle 16 ` # Increase parallelism
-Timeout 600 # Allow more time per DC
# For slow WAN links
.\Invoke-ADReplicationManager.ps1 `
-Mode Audit `
-Scope Site:RemoteSite `
-Throttle 4 ` # Reduce parallelism
-Timeout 900 # Increase timeout
# For fastest performance
pwsh -File .\Invoke-ADReplicationManager.ps1 ` # Use PS7
-Mode Audit `
-DomainControllers DC01,DC02,DC03,DC04,DC05,DC06,DC07,DC08 `
-Throttle 8| Permission | Purpose |
|---|---|
| Domain Admin | Full access to all DCs |
| OR Replication Management | DS-Replication-Manage-Topology |
| Local Admin on DCs | Remote operations (RPC/WMI) |
| Port | Protocol | Purpose |
|---|---|---|
| 135 | TCP | RPC Endpoint Mapper |
| 445 | TCP | SMB/CIFS |
| Dynamic RPC | TCP | AD Replication (49152-65535) |
| 389/636 | TCP | LDAP/LDAPS |
When -AuditTrail is enabled:
- β
Full transcript saved to
<OutputPath>\transcript-<timestamp>.log - β Includes all output, warnings, errors
- β Tamper-evident (cannot be modified during execution)
- β Suitable for compliance reviews (SOX, HIPAA, PCI-DSS)
| Feature | Default | Rationale |
|---|---|---|
| Mode | Audit |
Read-only, no changes |
| Scope | DCList |
Requires explicit DC list |
| AutoRepair | $false |
Requires confirmation |
| WhatIf | Available | Preview before execute |
| Old (v2.0) | New (v3.0) |
|---|---|
.\AD-Repl-Audit.ps1 -TargetDCs DC01,DC02 |
.\Invoke-ADReplicationManager.ps1 -Mode Audit -DomainControllers DC01,DC02 |
.\AD-ReplicationRepair.ps1 -AutoRepair |
.\Invoke-ADReplicationManager.ps1 -Mode Repair -DomainControllers DC01,DC02 -AutoRepair |
| Run both scripts | .\Invoke-ADReplicationManager.ps1 -Mode AuditRepairVerify -DomainControllers DC01,DC02 |
| Change | Impact | Migration |
|---|---|---|
Parameter renamed: TargetDCs β DomainControllers |
Medium | Update scripts |
| No HTML report | Low | Use CSV + BI tools |
Exit codes changed: 0/1 β 0/2/3/4 |
Medium | Update CI/CD logic |
-Mode parameter required |
Low | Defaults to Audit |
5-Week Migration Plan
Week 1: Testing
- Read
README.mdanddocs/MIGRATION-GUIDE.md - Run
Test-ADReplManager.ps1in lab - Test with
-WhatIfand-Verbose
Week 2: Production Audit
- Run audit-only in production
- Compare outputs with v2.0
- Validate detection logic
Week 3: Interactive Repairs
- Test repair mode with
-AuditTrail - Validate with your DCs
- Train team on new parameters
Week 4: Automation
- Update scheduled tasks
- Test
-AutoRepairin staging - Update documentation/runbooks
Week 5: CI/CD Integration
- Integrate
summary.jsoninto pipelines - Configure monitoring/alerting
- Archive old scripts (don't delete yet!)
π Full migration guide: docs/MIGRATION-GUIDE.md
|
|
"No output to console"
Cause: Output is now pipeline-friendly, not Write-Host
Fix: Use -Verbose or -InformationAction Continue
.\Invoke-ADReplicationManager.ps1 -Mode Audit -DomainControllers DC01,DC02 -Verbose
# Or
.\Invoke-ADReplicationManager.ps1 -Mode Audit -DomainControllers DC01,DC02 -InformationAction Continue"Scope=DCList requires -DomainControllers"
Cause: No DCs specified when using default scope
Fix: Add -DomainControllers or use -Scope Forest/Site:<Name>
.\Invoke-ADReplicationManager.ps1 -Mode Audit -DomainControllers DC01,DC02
# Or
.\Invoke-ADReplicationManager.ps1 -Mode Audit -Scope Forest"Module not found"
Cause: ActiveDirectory module not installed
Fix: Install RSAT
# Windows Server
Install-WindowsFeature RSAT-AD-PowerShell
# Windows 10/11
Get-WindowsCapability -Online | Where-Object Name -like "Rsat.ActiveDirectory*" |
Add-WindowsCapability -Online"Parallel processing not working"
Cause: PowerShell 5.1 doesn't support ForEach-Object -Parallel
Note: [Inference] Script uses serial processing on PS5.1
Fix: Upgrade to PowerShell 7 for parallel support
# Check version
$PSVersionTable.PSVersion
# Download PS7: https://aka.ms/powershell-release?tag=stableExit code 3 (Unreachable)
Cause: One or more DCs couldn't be contacted
Fix: Check network connectivity
# Test connectivity
Test-NetConnection DC01 -Port 135
Test-NetConnection DC01 -Port 445
# Test AD cmdlets
Get-ADDomainController -Identity DC01 -Server DC01
# Check firewall
Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*RPC*"}π Full troubleshooting guide: docs/TROUBLESHOOTING-GUIDE.md
Contributions are welcome! Please read CONTRIBUTING.md for guidelines.
Found a bug? Have a feature request?
- Check existing issues
- Create a new issue with:
- PowerShell version
- Environment details
- Error messages
- Steps to reproduce
# Clone repository
git clone https://github.com/adrian207/Repl.git
cd Repl
# Run tests
.\Test-ADReplManager.ps1 -TestDCs "DC01","DC02"
# Make changes, then test
.\Invoke-ADReplicationManager.ps1 -Mode Audit -DomainControllers DC01,DC02 -WhatIf -Verbose
# Submit pull requestThis project is licensed under the MIT License - see LICENSE file for details.
Adrian Johnson
π§ Email: adrian207@gmail.com
π GitHub: @adrian207
πΌ Role: Systems Architect / PowerShell Developer
If this tool helped you, please:
- β Star this repository
- π Share with colleagues
- π Report issues
- π‘ Suggest features
- π Improve documentation