| Event Id | 1109 |
| Source | Active Directory |
| Description | This directory has been restored from backup. The DSA Signature for replication (invocation id) has been changed from %1 to %2. The highest USN at the time the backup was made was %3. The invocation ID used to stamp changes originated on this server has been changed from %1 to %2. The highest USN to be associated with the previous invocation ID is %3. The invocation ID is changed when the server either is restored from backup or is configured to host a read/write application partition. |
| Event Information | Active Directory was restored from backup media. The InvocationID attribute for this domain controller was changed. The highest update sequence number at the time the backup was created is specified in the message. The InvocationID attribute is changed when a domain controller is restored from backup media or is configured to host a writeable application directory partition. No user action is required. |
| Reference Links | Monitoring AD Changes: Article |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.