Fix Active Directory Replication Error 5 Access Is Denied

Before you begin

Applicable to supported Windows Server/client environments where the named role or feature is installed. Run read-only checks first from an elevated PowerShell or Command Prompt as appropriate. Replace example hostnames, domain names, addresses, ports and paths with values from the affected environment. Record the exact error, timestamp, OS build and scope of impact.

Production safety: obtain change approval and a verified backup before modifying AD DS, DNS, DHCP, firewall, IIS, storage or Hyper-V configuration. Ensure console/out-of-band access before network or remote-access changes.

Symptoms and likely root cause

Repadmin shows error 5 Access is denied even though domain controllers resolve and ping each other.

Kerberos/time skew, DC computer account, secure channel, duplicate SPNs, authentication events or replication permissions.

Diagnostic commands

repadmin /showrepl * /errorsonly
repadmin /replsummary
w32tm /query /status
w32tm /monitor
nltest /sc_verify:corp.example.com
nltest /dsgetdc:corp.example.com /force
setspn -X
dcdiag /test:CheckSecurityError /v

Run the commands in order and save the complete output. The commands above are intended to establish the failing layer before a configuration change is attempted.

How to interpret the results

Capture the failing partner and naming context. Check KDC/Netlogon/Directory Service events on both DCs. Confirm time follows the domain hierarchy and secure-channel checks do not report errors. Duplicate SPN output requires ownership analysis, not automatic deletion.

Practical correction

Verify DC computer account is enabled and in the Domain Controllers OU with expected rights. Correct time hierarchy, DNS identity and authentication cause first. Use Microsoft-supported DC secure-channel repair guidance for the exact topology.

Make one change at a time. Re-run the failed diagnostic after each change so the cause-and-effect relationship is clear.

Fallback and recovery

Do not reset a DC machine-account password or delete SPNs as an initial step. Take system-state backup and involve an AD specialist before changing DC identity. Revert only the specific GPO/SPN/credential change that evidence identifies.

Verification checklist

Success: error 5 stops recurring, KDC/Netlogon errors cease and replication converges for all naming contexts.

• Repeat the original failing operation from the affected client/user or service.
• Test from a second approved endpoint or subnet where relevant.
• Review the relevant event log/IIS log after the fix.
• Record the change, actual result and any remaining limitation.

Frequently asked question

Should I reset the DC password? Not initially. Correlate time, KDC, Netlogon and security events first.

Official technical reference

Microsoft Learn — troubleshoot adreplication guidance

Use the official documentation for exact version support, prerequisites and any procedure that differs between Windows Server releases.

Technician field note

This runbook describes a controlled diagnostic path; it is not a universal guarantee that every environment has the same cause. If evidence does not match the expected result, stop and investigate rather than applying unrelated fixes. Do not mark the incident resolved until the original symptom is verified as cleared.