Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
The Knowledge Consistency Checker was unable to locate a replication connection for the read-only local directory service. A replication connection with the following option must exist in the forest for correct FRS system behavior.
Restore the original replication connection for the local directory service instance on a writable directory service instance.
|English: Request a translation of the event description in plain English.|
I ran into this in a customers environment. The RODC had lost it's RODC inbound connection. To manually recreate the connection, I performed on a writeable DC (in domain telco.com):
1. In adsiedit connect to configuration.
2. Locate the NTDS settings object for the RODC. The distinguish name of this object is: CN=NTDS SettingsCN=<server_name>CN=ServersCN=<site_name>CN=SitesCN=ConfigurationDC=telcoDC=com
3. Right click the NTDS settings object and click New Object.
4. Select nTDSconnection for the class
5. Enter RODC Connection (FRS) for Attribute cn
6. Enter 65 for Attribute options
7. Enter CN=NTDS SettingsCN=<writeable_dc>CN=ServersCN=<site_name>CN=SitesCN=ConfigurationDC=telcoDC=com for Attribute fromServer
8. Enter True for Attribute enabledConnection
9. Click Finish to create the object.
One could also attempt to demote and remove the RODC and re-promote it.
|Private comment: Subscribers only. See example of private comment|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated