Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
|Source: NTDS KCC|
The Directory Service consistency checker has noticed that 2 successive replication attempts with CN=NTDS Settings,CN=DESCARTES,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=altairtech,DC=net have failed over a period of 882 minutes. The connection object for this server will be kept in place, and new temporary connections will established to ensure that replication continues. The Directory Service will continue to retry replication with CN=NTDS Settings,CN=DESCARTES,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=altairtech,DC=net; once successful the temporary connection will be removed.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is NTDS and what are the roles of its components?
What is KCC?
What is a directory service?
This error may occur, when you have two or more domain controllers on the same site and you have just demoted or removed one of the servers. It is possible that you have Objects on the Active Directory related to the deleted server. Edit AD and remove the old server. Check the DNS too. Use ntdsutil.exe to search for the old server objects.
See the link to "EventID 1308 from source Active Directory" for information on this event.
Elliott Fields Jr
This message normally logged whenever the domain controller mentioned cannot be reached. This normally can be attributed to networking issues.
|Private comment: Subscribers only. See example of private comment|
|Links: EventID 1308 from source Active Directory|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated