Audit Directory Service Replication

  • Article

Audit Directory Service Replication determines whether the operating system generates audit events when replication between two domain controllers begins and ends.

Event volume: Medium on domain controllers.

Computer Type General Success General Failure Stronger Success Stronger Failure Comments
Domain Controller No No IF IF IF - Events in this subcategory typically have an informational purpose and it is difficult to detect any malicious activity using these events. It’s mainly used for Active Directory replication troubleshooting.
Member Server No No No No This subcategory makes sense only on domain controllers.
Workstation No No No No This subcategory makes sense only on domain controllers.

Events List:

  • 4932(S): Synchronization of a replica of an Active Directory naming context has begun.

  • 4933(S, F): Synchronization of a replica of an Active Directory naming context has ended.