| Event Id | 1587 |
| Source | NTDS Replication |
| Description | "The Directory Service Agent (DSA) corresponding to objectGuid d0a6a575-1702-4f4e-bf68-bb2a1f875188 has asked for changes starting at a bookmark preceding the local DSAs most recent restore from backup at USN 14727614. The bookmark is being adjusted as follows: Previous Invocation ID: bc546028-fae7-4178-abe0-d294694da32b Previous Object Update USN: 15853571 Previous Property Update USN: 15853571 New Invocation ID: ae6286cb-740b-4bb3-ace7-1577efa9dc1f New Object Update USN: 14727614 New Property Update USN: 14727614" |
| Event Information | According to Microsoft: CAUSE: This problem occurs because the domain controller assigns a new invocation ID, but uses the original highwater mark. WORKAROUND: To resolve this problem, obtain the latest service pack for Windows 2000. To work around this problem, demote and then promote the restored domain controller. Before you demote the affected server, force a full replication of the affected server to another domain controller. (The full synchronization can be resource intensive for larger domains.) Perform the full synchronization on the domain partition and on the configuration partition. The following line shows the syntax of the Repadmin command that you use to perform the synchronization: repadmin /sync <Naming Context> <Dest DC> <Source DC GUID> [/force] [/full] The following line is an example use of this command: repadmin /sync DC=domain,DC=root good_DC dc1 122a5239-36b3-488a-b24c-971ed0ca8a46 /force /full |
| Reference Links | Possible Active Directory Inconsistency After You Restore a Domain Controller |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.