Welcome to the Centrify Express forum.
Without having information about your environment, it is hard to pinpoint exactly what may be going on.
Always, when opening threads, please add OS, version, version of Centrify and basic layout of your environment.
However, I have a theory.
FSMO roles: Note that when you add a second domain controller, just so things aren't consolidated, some of the flexible roles might have been split between the two.
GCs: Your first domain controller will be automatically designated as a global catalog. However, if you did not explicitly designate the second one as a GC, you may have issues when the first one goes down.
These two topics may have impact on Centrify express since it exposes all users/all groups and has to calculate foreign principal membership (in 2-way trusts) or nested group membership.
Do this please:
a) report the version of Centrify express (you must be at 5.3.1 which is the community supported version)
b) Identify your FSMO roles using MMC or using the PowerShell command below in blue.
PS C:\> Get-ADDomainController -Filter * | Select Name, Domain, Forest, OperationMasterRoles | Where-Obj
ect {$_.OperationMasterRoles} | Format-Table -Autosize
Name Domain Forest OperationMasterRoles
---- ------ ------ --------------------
DC centrify.vms centrify.vms {SchemaMaster, DomainNamingMaster, PDCEmulator, RIDMaster...}
Note that I only have one domain controller in my demo environment so all is consolidated there.
c) Find out if the last added DC is also a Global Catalog
PS C:\> Get-ADForest | FL GlobalCatalogs
GlobalCatalogs : {dc.centrify.vms}
With this information in hand, you may want to re-consolidate FSMO roles or designate both systems as GCs and try to reproduce.
This is a first step.
R.P