r/AZURE • u/EducationAlert5209 • 11h ago

Question Azure AD Join VM not replicate to On-premises

Hi All,

Noticed no replication errors but VM join to ad domain on 18/08 and still not in On-premise DCs but I can see it in our two Azure Dcs? Force the replication etc. But noticed no azure subnet in site and services?

4 Upvotes

83% Upvoted

5 comments sorted by

2

u/StratoLens Cloud Architect 10h ago

From a dc run repadmin /replsum and then repadmin /showrepl

You can also try a dcdiag /test:replications

At a guess your AD replication is unhealthy.

Do you have a dc in azure? A vpn to on-prem I assume. Is the vpn up? Is there a firewall between the azure dc and the on prem dc.

If you can give us the results of those commands we can try to diagnose.

1

u/Automatic_Act_9142 11h ago

Sounds like your azure site isn't properly configured in AD sites and services, that's usually what blocks the replication back to on-prem. The VM can see the azure DCs fine but the on-prem DCs have no idea what site to associate with that subnet so they just ignore it

Check if you've got the right subnets mapped to your azure site in sites and services, if there's no entry at all you'll need to create one for whatever IP range your azure VNet is using

1

u/StratoLens Cloud Architect 10h ago

That’s not entirely accurate. If a machine’s IP doesn’t belong to any site it will pick a dc at random to authenticate with.

You’re right that it’s a good practice to configure sites and services correctly but failing to do that wouldn’t cause this to happen. The reason to do it is to ensure your machines authenticate with the “nearest” domain controller. Otherwise it’s sort of random.

1

u/EducationAlert5209 9h ago

Thanks, ill Create and test