Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1925 Source: NTDS KCC

The attempt to establish a replication link for the following writable directory partition failed.

Directory partition:
Source domain controller:
CN=NTDS Settings,CN=MCSA-DC-01,CN=Servers,CN=DC1-A,CN=Sites,CN=Configuration,DC=somedomain,DC=com
Source domain controller address:
Intersite transport (if any):

This domain controller will be unable to replicate with the source domain controller until this problem is corrected.  

User Action
Verify if the source domain controller is accessible or network connectivity is available.

Additional Data
Error value: <error code> <error message>.
- Error code: 1396 - See ME939820 for a hotfix applicable to Microsoft Windows Server 2003.
- Error code: 8439 - See ME948925.
- Error code: 5 (Error code 5) - See ME938702.
- Error code: 1727 (Error code 1727) - See ME911799.

See MSW2KDB for additional information about this event.
This is a generic message saying that the replication failed for the specified reason. The useful information is the one found in the "Additional data" as it provides a clue about the reason why the replication failed. Of course, another important detail is the actual partition that failed to replicate. As a result, any attempt to troubleshoot this problem should consider the specific error code, not just the event id itself.

* * *

Error 1908 (Could not find the domain controller for this domain.) - The "Event ID 1925: Attempt to establish a replication link failed due to connectivity problem" link provides suggestions on how to troubleshoot this connectivity problem.

Error 8524 The DSA operation is unable to proceed because of a DNS lookup failure. - Proceed with DNS testing as described in the "Event ID 2087: DNS lookup failure caused replication to fail." link.
This error can also occur if there is a missing or corrupted SYSVOL folder on the destination DC that this DC is trying to replicate to. First do a <CMD> net share to see if the SYSVOL shares are present. If you don't see the SYSVOL shares or you get errors, see article ME257338 for help in tracking down this problem.
This signifies errors between site replication. This is normally attributed to DNS configuration errors.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.