Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1587 Source: NTDSReplication

Level
Description
This domain controller has been restored or has been configured to host an application partition. As a result, its replication identity has changed. A partner has requested replication changes using our old identity. The starting sequence number has been adjusted.
The destination domain controller corresponding to the following object GUID has requested changes starting at a USN that precedes the USN at which the local domain controller was restored from backup media.

Object GUID:
158bc137-84e3-4b7f-aac2-36568045cb61
USN at the time of restore:
1633303

As a result, the up-to-dateness vector of the destination domain controller has been configured with the following settings.

Previous database GUID:
c7464231-39ca-4368-bd7b-1e75d0ec1b78
Previous object USN:
1641881
Previous property USN:
1641881
New database GUID:
ebf4b03f-16b1-478c-ab8a-39acb4beb915
New object USN:
1633303
New property USN:
1633303
Comments
 
We determined that there was a firewall policy keeping the new DC from Contacting the Domain Nameing Master FSMO roll holder. Thus preventing the sourcing of the DNSZones.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...