WinSecWiki > Security Settings > Local Policies > Audit Policy > DS Access > Detailed Replication

Detailed Directory Service Replication

This category only generates events on domain controllers. To configure this on Server 2008 you must use auditpol. Server 2008 R2 and later can use Group Policy. These events are more operational in nature than security and I recommend disabling the category except for troubleshooting purposes. Unable to produce a number of these events, I'm unsure whether they belong to this category or the Directory Service Replication category so I've listed the events in both categories.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
4928	An Active Directory replica source naming context was established.
4929	An Active Directory replica source naming context was removed.
4930	An Active Directory replica source naming context was modified.
4931	An Active Directory replica destination naming context was modified.
4934	Attributes of an Active Directory object were replicated.
4935	Replication failure begins.
4936	Replication failure ends.
4937	A lingering object was removed from a replica.

Back to top

 

Upcoming Webinars Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources