E.g. if a site is not listed as 'siteList' in the siteLink object samba_kcc silently doesn't replicate with any other server, thinks like these are very hard to debug. samba_kcc --debug gives too much information for a normal administrator to find the problem. It would be good to have an output like this: Intrasite DC=MYNAME SITE=MYSITE: Available DCs: DC1[online], DC2[WERR_HOST_UNREACHABLE], MYNAME, DC3[online], DC4[online], DC5[online], DC6[online], DC7[online], DC8[online] Selecting by ring topology: DC1, DC3 Optimizing connection(s) to: DC6 ISTG[MYNAME] Intersite replication required for the following Transport/Links: IP:DEFAULTIPSITELINK Available Bridgeheads: DC1[auto], DC2[WERR_HOST_UNREACHABLE], MYNAME, DC3[online], DC4[online], DC5[online], DC6[online], DC7[online], DC8[online] Available Sites: SITE1, SITE2, SITE3, MYSITE, SITE4, SITE5, SITE6, SITE7, SITE8 Selecting by ring topology: SITE3/DC37[auto], SITE4/DC42[preferred] Adding optimizing connection(s) to: SITE8/DC85[preferred] ... Update connections: MYNAME=>DC3 adding DC=newdomain,DC=addom,DC=example,DC=com Add connections: MYNAME=>DC1 for DC=... and DC=Schema, ... MYNAME=>DC6 for DC=... and DC=Schema, ... Removing connections: MYNAME=>DC2 Found non-autogenerated connections: .... Sync connections to repsFrom/repsTo: DC=addom,DC=example,DC=com Update repsFrom DC3 Remove repsFrom DC2 DC=newdomain,DC=addom,DC=example,DC=com Add repsFrom DC3 ... I hope you got the idea. The idea if that someone reading "How Active Directory Replication Topology Works" https://technet.microsoft.com/en-us/library/cc755994(v=ws.10).aspx has a chance to understand what's going on.