Fix 0X00002112: AD replication connection failed

Quick answer: Run repadmin /showrepl to identify which partner DC is failing. Then check DNS resolution of that partner's FQDN from the failing DC. If DNS is clean, open port 135 (RPC Endpoint Mapper) and high ephemeral ports (49152-65535) between both DCs. If still broken, force replication with repadmin /syncall after fixing the network path.

Why you're seeing 0X00002112

This error happens when a domain controller tries to pull changes from a replication partner but the connection fails. I've seen it most often when someone moves a DC to a different subnet, changes firewall rules, or a DNS record goes stale. The real trigger is that the destination DC can't reach the source DC's RPC endpoint—either the port is blocked, or the name resolves to the wrong IP.

The error code 0X00002112 maps to ERROR_DS_DRA_EXTN_CONNECTION_FAILED. It's not a data corruption issue; it's a network or name resolution problem 99% of the time. So don't waste time on NTDS database repairs—that's not it.

Step-by-step fix

Step 1: Find the failing replication partner

Open PowerShell or Command Prompt as Administrator on the DC showing the error. Run:

repadmin /showrepl

Look for the line with 0X00002112. It will tell you the source DC that's failing. Write down that DC's full computer name (like DC2.corp.example.com).

Expected outcome: You'll see a status column with the error code next to a specific source DC. That's your target.

Step 2: Test DNS resolution of the source DC

On the failing DC, run this against the source DC's name you found:

ping DC2.corp.example.com
nslookup DC2.corp.example.com

Both should return the correct IP address of the source DC. If ping fails but nslookup works, there's a firewall blocking ICMP—that's fine, but AD replication doesn't need ICMP. If nslookup fails or returns a wrong IP (like 127.0.0.1 or an external address), then DNS is your real problem.

If DNS is wrong, check the source DC's own DNS registration. On the source DC, run ipconfig /registerdns and then net stop netlogon && net start netlogon to force SRV record updates. Then go back to the failing DC and run ipconfig /flushdns and repadmin /syncall /AdeP.

Step 3: Check firewall rules for RPC ports

Active Directory replication uses RPC. It first contacts the source DC on TCP port 135 (RPC Endpoint Mapper). The mapper then assigns a random high port (usually in the 49152-65535 range) for the actual replication traffic. If a firewall blocks these high ports, you get 0X00002112.

On the source DC, open Windows Defender Firewall with Advanced Security. Look for inbound rules that allow:

• Active Directory Replication (if that rule exists)—it's pre-configured in newer Windows Server versions.
• If not, add a custom rule for TCP ports 49152-65535 and TCP 135.

Better yet, restrict the RPC port range on the source DC to a specific set (like 50000-50100) and open only those. Here's how:

1. On the source DC, open Registry Editor.
2. Go to HKLM\SOFTWARE\Microsoft\Rpc\Internet.
3. Create a REG_SZ called Ports with value 50000-50100.
4. Create a REG_SZ called PortsInternetAvailable with value Y.
5. Create a REG_SZ called UseInternetPorts with value Y.
6. Reboot or restart the RPC service.

Then open those same ports (TCP 50000-50100) plus TCP 135 in the firewall of the source DC. This is cleaner than opening 16,000 ports.

Step 4: Force replication after fixing the network path

Once DNS and firewall checks pass, run this on the failing DC:

repadmin /syncall /AdeP

This forces replication with all partners. Watch the output. If you still see 0X00002112, there's a physical connectivity issue—check network cables, VLANs, or VPN tunnels between sites.

Expected outcome: No errors. The command completes with success messages like "Sync request sent to DC2.corp.example.com".

Alternative fix: Check site links and topology

If the main steps didn't help, look at Active Directory Sites and Services. Open it from Server Manager > Tools. Expand Sites > Inter-Site Transports > IP. Check the site link connecting the two DCs' sites. Make sure the sites are joined via a site link, and the cost is reasonable (like 100 or less). If the sites aren't linked, replication can't happen at all.

Also, check the NTDS Settings object under each DC's server object. Right-click on it, select Properties, and verify that the source DC is listed as a replication partner. If it's missing, add it manually.

Prevention tip

Set up a scheduled task on each DC that runs repadmin /showrepl daily and emails you the results. I use a simple PowerShell script that parses the output for 0X00002112 or other replication errors. That way you catch issues within 24 hours, not when a user can't log in. Also, use a monitoring tool like PRTG or Zabbix to watch for RPC port availability between all your DCs.