Fix ERROR_DS_REPLICATOR_ONLY (0X000020B2) Quick

Quick answer: Run repadmin /syncall /AdeP from the affected DC, then perform a non-authoritative restore of the NTDS database using DSRM, or reset the NTDS Settings object permissions via ADSI Edit.

Why you're seeing this error

You've got the 0X000020B2 error, and it's infuriating because it stops replication cold. I know—I've spent late nights chasing this one. The error message says "Only the replicator can perform this function," which is Microsoft's way of telling you that the domain controller trying to make a change isn't recognized as a replication partner by the source DC.

This usually happens after an improper restore of a DC, a failed domain controller promotion, or when two DCs get out of sync during a replication storm. The NTDS Settings object on the affected DC has lost its security descriptor or has an invalid replication state. The source DC flat-out refuses the inbound replication request because the destination DC doesn't have the right permissions or isn't listed as a valid replica.

Here's a real-world trigger: You restore a backup of a DC to a new server, but you don't run an authoritative restore first. The restored DC tries to sync with its partner, but the partner sees a stale invocation ID and blocks it. Boom—0x000020B2.

Fix steps

1. Identify the affected DC and source DC. Check the event log for event IDs 1925, 1926, or 2042. Look at the repadmin /showrepl output to see which DC is failing to replicate from which source.
2. Force replication from the source DC to the affected DC. On the source DC, run:

   repadmin /syncall /AdeP
   

   This pushes all pending changes. If it fails with 0x000020B2 again, proceed to step 3.
3. Restart the KDC service on both DCs. Sometimes a stale Kerberos ticket causes this. Run:

   net stop kdc && net start kdc
   

   Then retry replication with repadmin /syncall.
4. Check the NTDS Settings object permissions. Open ADSI Edit. Connect to the Configuration partition. Expand CN=Configuration, CN=Services, CN=Windows NT, CN=Directory Service. Find the NTDS Settings object for the affected DC. Right-click → Properties → Security. Verify the ENTERPRISE DOMAIN CONTROLLERS group has Full Control. If not, add it. This is often the fix—permissions get stripped after a restore.
5. Reset the invocation ID (last resort—only if you're okay with a non-authoritative restore). On the affected DC, boot into Directory Services Restore Mode (DSRM). Open a command prompt and run:

   ntdsutil
   activate instance ntds
   metadata cleanup
   remove selected server %affected_dc%
   

   Then exit and reboot normally. The DC will perform a non-authoritative sync and get a fresh invocation ID from its partner.

Alternative fixes if the main one fails

• Demote and re-promote the affected DC. This is nuclear but guaranteed. Run dcpromo /forceremoval on the affected DC, clean up metadata via ADSI Edit, then re-promote. It's painful but works when nothing else does.
• Manually adjust the replication schedule. Open Active Directory Sites and Services, find the NTDS connection object, go to Properties → Schedule, and set it to replicate every 15 minutes. Some admins report that a stale schedule triggers this error.
• Check for lingering objects. Run repadmin /removelingeringobjects from the source DC targeting the affected DC. If there are objects the source doesn't recognize, it can throw 0x000020B2.

Prevention tip

Never restore a DC backup without first running ntdsutil and performing a non-authoritative restore. Always ensure the restored DC's invocation ID is reset during the process. Also, run repadmin /showrepl weekly to catch replication errors early. A 5-minute check saves you a 2-hour fire drill later.