| Event Id | 1311 |
| Source | NTDS KCC |
| Description | The Knowledge Consistency Checker (KCC) has detected problems with the following directory partition. |
| Event Information | CAUSE:
In Windows 2000, the Knowledge Consistency Checker (KCC) uses the Intersite Messaging service to help it build the spanning tree topology for Microsoft Active Directory directory service replication. In a very small percentage of cases, Intersite Messaging may not complete building the hash table that it passes to the KCC. When the KCC uses this hash table in its calculations, this may generate the KCC logging event ID 1311 in the Directory Services event log. This problem typically occurs in environments with large numbers of sites, domain controllers, and domains. RESOLUTION: A supported fix is now available from Microsoft Additional information about this event: This error can occur when you have several sites that dont have a site link between them, site-link bridging is disabled (and no site-link bridge has been manually created), and some sites have a DC that runs DNS and is connected to a site that has DCs that dont run DNS. The ForestDNSZones partition, which replicates only between DCs that have DNS installed, cant replicate across the DCs that dont have DNS installed. With reference to this structure [ DC (A) with DNS<=> DC (B)<=> DC (C) with DNS] ,the error appears on DCs in sites A and C, assuming that no DCs in site B have DNS installed, site-link bridging is disabled, and no site-link bridge was manually created. To solve this problem, you must either create a site-link bridge between sites A and C or, if sites A and C arent connected because of routing restrictions, install DNS on a DC in the central site (B). Using either method allows replication through the DC in site B. You dont need to configure any zones on the DC; merely having DNS installed is enough to add the DC to the ForestDNSZones partitions replication set. |
| Reference Links | You Receive an "Event ID 1311" Message Every 15 Minutes in the Directory Services Event Log How to Troubleshoot Event ID 1311 Messages on a Windows 2000 Domain Troubleshooting Event ID 1311: Knowledge Consistency Checker Troubleshooting Active Directory Replication Problems Fixing Replication Topology Problems (Event ID 1311) |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.