| Event Id | 2088 |
| Source | NTDS Replication |
| Description | Active Directory could not use DNS to resolve the IP address of the source domain controller listed below. To maintain the consistency of Security groups, group policy, users and computers and their passwords, Active Directory successfully replicated using the NetBIOS or fully qualified computer name of the source domain controller. |
| Event Information | According to Microsoft: CAUSE : DNS lookup problems may cause Active Directory replication to fail in one of the following ways: • Case 1: A domain controller tries to replicate with another domain controller that is offline, and Active Directory and DNS data for the offline domain controller has not been updated or deleted to indicate that the domain controller is inaccessible. • Case 2: A domain controller tries to replicate with another domain controller that is online, but because of DNS or networking issues, the domain controllers cannot locate each other. All domain controllers register SRV, A, and CNAME records in DNS. The CNAME record is of the form Dsa_Guid._msdcs.Dns_Domain_Name. Dsa_Guid is the GUID of the directory system agent (DSA) object for the domain controller. Dns_Domain_Name is the name of the forest where the domain controller is located. Domain controllers require the CNAME record to locate and to identify their replication partners. The Net Logon service on the domain controller registers all the SRV records. The DNS Client service on the domain controller registers the DNS host (A) record and the GUID CNAME record.A domain controller uses the following steps to locate its replication partner: 1. The domain controller uses DNS to look for the CNAME record of its replication partner. 2. If the lookup is unsuccessful, the domain controller looks for the DNS A record of its replication partner. For example, the domain controller looks for dc-03.corp.contoso.com. 3. If the DNS A record lookup is unsuccessful, the domain controller performs a NetBIOS broadcast by using the host name of its replication partner. For example, the domain controller uses dc-03. User Action: 1) If the source domain controller is no longer functioning or its operating system has been reinstalled with a different computer name or NTDSDSA object GUID, remove the source domain controllers metadata |
| Reference Links | Resolution for Event id 2088 Troubleshooting Active Directory replication failures that occur because of DNS lookup failures, event ID 2087, or event ID 2088 Q216498:remove data in Active Directory after an unsuccessful domain controller demotion |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.