What you’re seeing
- Directory Service Event ID 2042 stating it has been too long since this machine last replicated with the named source.
- Password changes made on one domain controller don't work on another.
- New users, group changes or disabled accounts appear on some DCs but not others.
- Replication reports show errors and a last-success date that is weeks or months old.
- Users at a branch office see different results from users at headquarters.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- A domain controller was offline or unable to replicate for longer than the tombstone lifetime.
- DNS problems prevent domain controllers from finding each other's replication addresses.
- Firewall rules or network changes block the ports and protocols replication needs.
- A domain controller was restored from an old backup or snapshot and is now out of step.
- Time differences between domain controllers exceed what Kerberos authentication allows.
Why it matters
When domain controllers stop replicating, Active Directory no longer has one version of the truth. A terminated employee might be disabled on one DC but still able to log in through another, a serious security gap. Password resets and new hires work unpredictably depending on which server answers. After a long outage, reconnecting a stale DC can reintroduce deleted objects, so careful handling is essential. This is one of the problems that should not be ignored even if things seem mostly fine.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Can former employees still log in because of this?
Possibly, if their account was disabled on a DC that hasn't replicated. An engineer can check the status of sensitive accounts on every domain controller.
Why does Windows block replication after too long?
It's a safety measure. A DC that's been out of contact too long could bring deleted accounts back, so replication is blocked until the situation is reviewed.
Is this safe to fix remotely?
Yes, in most cases. We confirm the cause and the state of each domain controller before changing anything.