Pretty certain you can't do this programatically. These are the only urgent replication triggers: http://technet.microsoft.com/en-us/library/cc772726%28v=WS.10%29.aspx#w2k3tr_repup_how_huzs
Assigning an account lockout, which a domain controller performs to prohibit a user from logging on after a certain number of failed attempts. An account unlock is not urgently replicated. Changing the account lockout policy. Changing the domain password policy. Changing a Local Security Authority (LSA) secret, which is a secure form in which private data is stored by the LSA (for example, the password for a trust relationship). Changing the password on a domain controller computer account. Changing the relative identifier (known as a βRIDβ) master role owner, which is the single domain controller in a domain that assigns relative identifiers to all domain controllers in that domain. - WJR πππ On Fri, Jan 24, 2014 at 4:32 PM, Joseph L. Casale <[email protected] > wrote: > I have a provisioning application that at two different stages contacts AD > and manipulates > an existing account object via LDAP to change its sAMAccountName and > userPrincipalName > and later via ADSI, creates a new account object with the old values. > > Problem exists with replication, the create always fails as its not > performed late enough after > the original account is manipulated and therefor an account exists if it > hits a new dc. > > What programmatic means can I trigger an immediate replication of the > account object, and > invalidate the old data? A lockout does this, but via ldap I am not aware > of a means to do this > elegantly? > > Anyone have any insight to this? > jlc > >
