Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
|Source: NTDS KCC|
The call to the Intersite Messaging Service (ISM) specifying the transport CN=IP,CN=Inter-Site Transports,CN=Sites,CN=Configuration,DC=dsqalab,DC=volvo,DC=net failed with the following status:
The RPC server is unavailable.
This condition is causing the Directory Service consistency checker to fail to correctly configure an inter site replication topology. Please verify that the ISM is running and the correct plug-in dll for the transport is available.
The record data is the status code.
0000: ba 06 00 00
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is a DLL?
What is NTDS and what are the roles of its components?
What is KCC?
What is the Intersite Messaging?
What is a directory service?
See the link to "EventID 1312 from source Active Directory" for information about this event.
To resolve this problem, access your services, mark the "Intersite Messaging" service as Automatic, and press Start.
See ME834317 for a hotfix applicable to Microsoft Windows Server 2003.
This event, together with event 1311 from the same source may show up if the Intersite Messaging Service (ISM) is disabled. The Microsoft "Security Operations Guide for Wndows 2000 Server" states that this service can be disabled if you do not use SMTP for AD replication, but this seems to be wrong. The service is needed even if you have IP based replication.
|Private comment: Subscribers only. See example of private comment|
|Links: ME834317, EventID 1312 from source Active Directory|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated