Event ID - 1473

Event Id	1473
Source	Microsoft-Windows-ActiveDirectory_DomainService
Description	The Intersite Messaging service could not read the intersite transport objects from AD_TERM. As a result, the Intersite Messaging service has stopped. The Knowledge Consistency Checker (KCC) will be unable to calculate intersite topology without this service. User Action Verify that LDAP queries function properly on this machine. Restart the Intersite Messaging service to continue intersite communication. Additional Data Error value:%2 %1 .
Event Information	According to Microsoft : Cause : This event is logged when the Intersite Messaging service could not read the intersite transport objects from AD_TERM. Resolution : Restart the Intersite Messaging service Perform the following steps on the domain controller that is reporting the issue. To perform these procedures, you must have membership in Enterprise Admins, or you must have been delegated the appropriate authority. To ensure that the Intersite Messaging service is running: If you are not currently logged on with an account that has membership in the Enterprise Admins group, you can use the runas command to open a command prompt with elevated credentials. To do this, click Start in Start Search, type runas /user:domain\account cmd, and then press ENTER. Substitute the actual domain name and user account name of an account that is a member of the Enterprise Admins group for domain and user. Type the password for the account when you are prompted. A command prompt opens under the security context of the account that you provided. To stop the Intersite Messaging service, type net stop ismserv, and then press ENTER. Do not be concerned if you see a message indicating that the service is not running. To start the Intersite Messaging service, type net start ismserv, and then press ENTER. The service starts, or a status message appears, informing you that the service is already running or the service failed to start. If the service failed to start, check the Directory Service and System logs in Event Viewer for additional information related to service startup failures. Verify : Perform the following procedure on the domain controller on which you want to verify that the Knowledge Consistency Checker (KCC) is functioning. To perform this procedure, you must have membership in Domain Admins, or you must have been delegated the appropriate authority. To verify that the KCC is computing replication paths: Open a command prompt as an administrator. To open a command prompt as an administrator, click Start. In Start Search, type Command Prompt. At the top of the Start menu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue. Run the command repadmin /kcc. This command starts KCC translation of domain controllers, to which the local domain controller replicates. Check Event Viewer to see if there are any failure messages that are related to the KCC. If there are no error events that are related to the KCC, it is functioning properly. If there are error events, use the additional information in them to resolve the issue.
Reference Links	Event ID 1473 from Source Microsoft-Windows-ActiveDirectory_DomainService

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught