Skip to main content
Version: 2.2.1-preview

AD-REPL-02 - Non-auto replication connection count should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Non-auto-generated (manual) replication connections bypass the Knowledge Consistency Checker (KCC) automatic topology generation. While sometimes necessary for specific scenarios, manual connections require careful management:

  • Topology Bypass: Manual connections don't benefit from automatic optimization and failover
  • Documentation Gap: Manual connections may lack proper documentation of their business purpose
  • Operational Debt: Accumulated manual connections from past troubleshooting may no longer be needed
  • Security Risk: Undocumented connections may hide unauthorized replication paths

Security Recommendation​

  • Prefer auto-generated connections for standard replication topology
  • Document all manual connections with business justification
  • Regularly audit manual connections to ensure they are still required
  • Remove manual connections that are no longer needed
  • Use manual connections only for specific scenarios like site bridging

How the Test Works​

This test retrieves all Active Directory replication connections and identifies:

  • Auto-generated vs. manual connections
  • Count and percentage of manual connections
  • Total replication connection count
  • Test-MtAdDisabledReplicationConnectionCount - Identifies disabled replication connections

Test Metadata​

FieldValue
Test IDAD-REPL-02
SeverityInfo
SuiteActive Directory
CategoryAD.Replication
PowerShell testTest-MtAdNonAutoReplicationConnectionCount
TagsAD, AD-REPL-02, AD.Replication

Source​

  • Pester test: tests/ad/replication/Test-MtAdNonAutoReplicationConnectionCount.Tests.ps1
  • PowerShell source: powershell/public/ad/replication/Test-MtAdNonAutoReplicationConnectionCount.ps1