Skip to content

Interpreting Event Logs

The event logs are a critical diagnostic resource for identifying replication failures in Active Directory. Replication-related errors are logged under Directory Services, System, and Application logs in Event Viewer. These logs provide timestamps, event IDs, and contextual details about failed replication attempts, network issues, or configuration mismatches. Understanding these logs is essential for isolating root causes such as communication failures, schema inconsistencies, or time synchronization problems.

Understanding Event Log Sources

Directory Services Log

  • Location: Windows Logs > Directory Services
  • Focus: Replication-related errors (e.g., failed replication attempts, connection issues).
  • Key Event IDs: 1351, 1376, 1386, 1395, 16192, 16193.

System Log

  • Location: Windows Logs > System
  • Focus: General system-level issues (e.g., network connectivity, time synchronization).
  • Key Event IDs: 41, 47, 6008 (for system crashes), 10000+ (for hardware or driver issues).

Application Log

  • Location: Windows Logs > Application
  • Focus: Third-party tools or custom scripts that interact with AD replication.

Common Event IDs and Their Meanings

Event ID 1351: Replication Failure

  • Description: A replication attempt failed due to a communication error, DC downtime, or configuration issues.
  • Possible Causes:
  • Network connectivity between DCs is down.
  • A domain controller is offline or unreachable.
  • DNS resolution issues prevent the DC from locating the target.
  • Resolution: 
    Test-NetConnection -ComputerName <TargetDC>
nslookup <TargetDC>
    Verify DNS settings and ensure all DCs are online.

Event ID 1376: Replication Connection Failure

  • Description: A replication connection to a remote DC failed.
  • Possible Causes:
  • Firewall rules block replication ports (TCP 389, 636, 3268, 3269).
  • Incorrect replication metadata (e.g., incorrect site assignments).
  • Resolution: 
    repadmin /replsum
dcdiag /test:replications
    Check firewall settings and validate replication metadata using repadmin /showrepl.

Event ID 1386: Failed Replication

  • Description: A replication attempt failed due to a schema or configuration mismatch.
  • Possible Causes:
  • Schema inconsistencies between DCs.
  • Corrupted AD database (NTDS.dit).
  • Resolution: 
    ntdsutil "roles" "list roles" q
    Use ntdsutil to check for schema issues. Consider restoring from a backup if corruption is suspected.

Event ID 1395: Replication Not Started

  • Description: Replication was not initiated due to a missing or invalid configuration.
  • Possible Causes:
  • Missing replication partners in the configuration.
  • Incorrect site or subnet assignments.
  • Resolution: 
    repadmin /showrepl
    Validate replication partners and site/subnet settings in AD Sites and Services.

Event IDs 16192/16193: Replication Latency

  • Description: Indicates replication latency (e.g., delayed updates across DCs).
  • Possible Causes:
  • Network congestion or high latency between DCs.
  • Large replication batches causing delays.
  • Resolution: 
    repadmin /replsum
    Monitor latency trends and optimize network performance or split large replication batches.

Troubleshooting Steps

  1. Use repadmin /replsum to summarize replication status: 

    repadmin /replsum
    This command provides a quick overview of replication health, including latency and errors.

  2. Run dcdiag /test:replications for comprehensive diagnostics: 

    dcdiag /test:replications
    This tool checks replication connectivity, schema consistency, and other critical factors.

  3. Check DNS resolution for all DCs: 

    nslookup <DCName>
    Ensure DNS records (A, SRV, CNAME) are correctly configured.

  4. Verify time synchronization using w32tm: 

    w32tm /query /status
    Time drift greater than 5 minutes can cause replication failures.

  5. Review replication metadata with repadmin /showrepl: 

    repadmin /showrepl
    Look for errors in the "DSA Partitions" and "DSA Replication" sections.

Key takeaways

  • Check Directory Services logs for event IDs 1351, 1376, 1386, 1395, 16192, and 16193 to identify replication failures.
  • Use repadmin and dcdiag to validate replication health and diagnose connectivity issues.
  • Investigate network connectivity, DNS resolution, and time synchronization when replication errors occur.
  • Monitor replication latency with repadmin /replsum to detect performance bottlenecks.
  • Regularly run diagnostic tools to proactively identify and resolve replication problems.