| Event Id | 1115 |
| Source | NTDS General |
| Description | Outbound replication has been disabled by the user. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp Additionally, the Netlogon service on this domain controller has been paused and will subsequently not be used to service user logons or global catalog queries. |
| Event Information | According to Microsoft: Windows 2000 domain controllers use USNs in combination with the invocation IDs of source domain controllers to track updates to Active Directory that must be replicated. When USNs and invocation IDs are used, all domain controllers maintain consistent copies in Active Directory of the directory database partitions that are replicated. The invocation ID identifies the version of the directory database that is running on the domain controller. When the system state is correctly restored on a domain controller, the invocation ID is reset before Active Directory starts. Therefore, the domain controller is identified to its replication partners as a new domain controller. This situation prompts other domain controllers to update the restored domain controller. System state restorations that Active Directory-aware backup programs perform use APIs and methods that Microsoft has designed and tested. These APIs and methods help make sure that local and replicated Active Directory databases are consistent when the restoration is complete. These APIs and methods also make sure that other domain controllers in the forest are notified that invocation IDs have been reset. |
| Reference Links | How to detect and recover from a USN rollback in Windows Server 2003 How to detect and recover from a USN rollback in Windows 2000 Server |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.