| Event Id | 2103 |
| Source | NTDS General |
| Description | The Active Directory database has been restored using an unsupported restoration procedure. Active Directory will be unable to log on users while this condition persists. As a result, the Net Logon service has paused. User Action See previous event logs for details. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. |
| Event Information | According to Microsoft: Windows 2000 domain controllers use USNs in combination with the invocation IDs of source domain controllers to track updates to Active Directory that must be replicated. When USNs and invocation IDs are used, all domain controllers maintain consistent copies in Active Directory of the directory database partitions that are replicated. The invocation ID identifies the version of the directory database that is running on the domain controller. When the system state is correctly restored on a domain controller, the invocation ID is reset before Active Directory starts. Therefore, the domain controller is identified to its replication partners as a new domain controller. This situation prompts other domain controllers to update the restored domain controller. System state restorations that Active Directory-aware backup programs perform use APIs and methods that Microsoft has designed and tested. These APIs and methods help make sure that local and replicated Active Directory databases are consistent when the restoration is complete. These APIs and methods also make sure that other domain controllers in the forest are notified that invocation IDs have been reset. |
| Reference Links | How to detect and recover from a USN rollback in Windows Server 2003 How to detect and recover from a USN rollback in Windows 2000 Server |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.