Fix ERROR_DS_DIFFERENT_REPL_EPOCHS 0X00002191

What you're dealing with

You're seeing ERROR_DS_DIFFERENT_REPL_EPOCHS (0X00002191) on a domain controller, likely in the Directory Services event log or in DCDiag output. This means two or more DCs have different replication epochs — basically, they disagree on what version of the directory they're syncing. You'll usually see this after a failed replication attempt, a server restore, or a hardware failure. Don't panic. It's fixable.

Start here: the 30-second check

Step 1: Run DCDiag to confirm the error

Open Command Prompt as Administrator on the problematic DC. Type:

dcdiag /test:replications /v

After the test runs, look for any line containing 0X00002191. You should see something like: "Failed to replicate with error 0X00002191 ERROR_DS_DIFFERENT_REPL_EPOCHS". If you don't see this, you might be chasing the wrong error. Stop here and double-check the exact error code.

Step 2: Quick repadmin status

Run this to see which DCs are failing:

repadmin /showrepl * /csv | find /i "0x2191"

You'll get a list of source and destination DCs with that error. Write down the source DC name — that's the troublemaker.

Moderate fix: force a sync (5 minutes)

Step 1: Sync from the source DC

On the problematic DC, run:

repadmin /syncall /AdeP

This tells the DC to push all partitions to all partners. After it finishes — usually 30-60 seconds — run the dcdiag test again. If the error's gone, you're done. If not, move on.

Step 2: Check time sync

Epoch mismatches often happen when DC clocks drift. On the same DC, run:

w32tm /query /status

Look for Source — it should point to a reliable time source (like the PDC emulator). If it says Local CMOS Clock, you've got a time issue. Fix it:

w32tm /resync /nowait

Then re-run repadmin /syncall. Still failing? Go to the advanced fix.

Advanced fix: reset the replication epoch (15+ minutes)

This step forces the source DC to reset its epoch. You'll need to stop the NTDS service, clear the replication queue, and restart. Make sure you're on the source DC (the one from the repadmin output).

Step 1: Stop the NTDS service

Open Services.msc, find Active Directory Domain Services, right-click, and select Stop. Or use the command:

net stop ntds

Wait for the service to stop. You'll see "The Active Directory Domain Services service was stopped."

Step 2: Clear the replication queue

Open Command Prompt as Administrator and run:

ntdsutil
activate instance ntds
quit
metadata cleanup
connections
connect to server localhost
quit
quit

This opens the metadata cleanup tool. Now run:

select operation target
list domains
select domain 0
list sites
select site 0
list servers in site
select server 0
quit
remove selected server

When prompted, confirm the removal. This clears any stuck replication metadata. After it finishes, type quit to exit ntdsutil.

Step 3: Restart the NTDS service

net start ntds

Wait for the service to fully start — check the Directory Services event log for "The Active Directory Domain Services service has started." (Event ID 1000).

Step 4: Force a full sync

repadmin /syncall /AdeP /force

The /force flag bypasses the epoch check. After it completes, run DCDiag again:

dcdiag /test:replications /v

You should see "passed test Replications" with no errors. If the 0X00002191 error is gone, you're done.

What to do if it still fails

If you've done all three fixes and the error persists, you've got a deeper issue. Check the source DC's system event log for disk or hardware errors. Also verify that the source DC's replication partner is reachable and not in a bad state. In rare cases, you might need to demote and re-promote the failing DC. That's a last resort — it works, but it's heavy. Try the steps here first.

Pro tip: Always run these commands from an elevated prompt. If you're using Server Core, you can do everything from PowerShell with the Active Directory module. And never skip checking time sync — it's the number one cause of epoch mismatches in my experience.