How to find the client Name or client IP Address that issues the Event ID 2896.

Question

Hi,
With DC1 , DC2 and RODC3, we get all days at 10:00PM, only on DC2, the EventViewer\DirectoryService error:
A client made a DirSync LDAP request for a directory partition. Access was denied due to the following error (Event ID 2896):

"

Directory partition:
DC=sub,DC=contoso,DC=DOM
Error value:
8453 Replication access was denied.

User Action
The client may not have access for this request. If the client requires it, they should be assigned the control access right "Replicating Directory Changes" on the directory partition in question.

"

How we can finding the client IP or name for identify who try to replicate with DC2 at 10:00PM of each day?

Answer 1

Look here:
Active Directory replication error 8453: Replication access was denied
https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/replication-error-8453

Answer 2

In the Event Viewer, click on the Details tab of the event, then expand the System branch by clicking on the plus sign. Under Security, you should see the SID of the user making the request. You can find the user from the SID (e.g. Get-ADUser -Filter 'SID -eq "S-1-5-21-1234567890-123456789-12345678-12345"')