Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
The GUID on server <Server Name> has changed from <GUID> <Server Name> to <GUID> <Server Name>. This causes all replicas to be resynced from scratch.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is a GUID?
What is the role of the Microsoft Exchange Directory service?
Woodrow Wayne Collins
Servers may incorrectly log this event in the event log. According to Microsoft "when there are a lot of changes to be replicated, it may take multiple calls to transfer the data between the servers. If during the multiple calls there is a remote procedure call (RPC) error, the global universal identification (GUID) on the REPS-FROM for the calling server is reset to the invocation ID of the local server. The next replication cycle detects the GUID change and logs the 1349 error. This logic error causes unnecessary naming context resynchronizations". This is a bug fixed in the latest service pack for Exchange Server 5.5. See ME246214 link below.
"When you have two multi-server sites with the same organization and site name and same service account, and you remove a server from one site and install it in the other site without deleting the server from the original site, the two sites will join together". In this case see ME243398 for more information.
|Private comment: Subscribers only. See example of private comment|
|Links: ME243398, ME246214|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated