| Event Id | 5512 |
| Source | NetLogon |
| Description | The server <server name> and <server name> both claim to be the primary domain controller for the <domain name> domain. One of the servers should be demoted or removed from the domain. |
| Event Information | According to Microsoft: Whenever domain administration tools are used, the changes or additions occur at the PDC. When domain synchronization occurs, these changes or deltas are sent from the PDC to the BDC using this one-way replication. Because a "stand-in" PDC was necessary while the "original" PDC was offline, changes have probably been made to the database on the stand-in computer; it will be important for it to remain the PDC while the original PDC is demoted. Successfully demoting the original PDC will also cause a synchronization with the stand-in PDC, giving it the recent changes done during its absence. Later, the original PDC can once again resume the role of PDC for the domain by simply promoting it in Server Manager. It may be possible for more than one PDC to be active in a domain at the same time. This may cause serious problems, but can be the result of several things. If a network connection such as a router or cable fails, and during this failure a BDC was promoted, when the failure is resolved, two PDCs will be active in the domain. Because both are already running, the Netlogon service does not have the chance of detecting another PDC at startup time and fails to start. Some other reasons for having more than one PDC active would be because there is a very slow WAN link, the WINS databases are out of sync, not configured as push or pull partners, or replicating too slowly. |
| Reference Links | How to Demote to BDC When Two PDCs Present |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.