Overview
The AD Events monitoring test appears under AD Replication, in the AD Core section for domain controllers.
AD Replication covers four related tests: Replication Status, Diagnostics, AD Events, and DFS Replication. This page covers AD Events.
Monitoring Benefit
The AD Events test watches the event logs on each domain controller for the specific event IDs that indicate an Active Directory replication problem. Where one of those events is found, the indicator changes and an alert is sent.
This complements the Replication Status test rather than duplicating it. Replication Status reports whether replication attempts are currently succeeding; AD Events catches the conditions Windows itself has logged — including problems that were recorded and have since cleared, and problems that have not yet caused an attempt to fail outright.
AD Events is the one monitoring feature not available on Read-Only Domain Controllers. Every other check available for a domain controller is also available for an RODC, but not this one. If you are looking for AD Events against an RODC and cannot find it, that is why — it is not a configuration problem.
How do we verify the monitoring test results?
1. Check the collected data on the EMS web server. Open this file in a browser from Explorer, substituting the domain controller's name:
\Program Files (x86)\ENow\MailscapeWeb\MailscapeData\LogFiles\<ServerName>\NetworkAgentMessage.xmlLocate RepAdminInfo and ActiveDirectoryReplication and confirm they match what the monitoring page shows. DFS replication data is held separately, in DFSReplication.xml and DFSSYSVOLReplication.xml.
2. Check the client-side cache on the domain controller. The Compass client stores its results here rather than logging them:
\Program Files (x86)\ENow\Mailscape Agent\Cache\NetworkAgentMessage.xml3. Look at the events themselves. The alert names the event that was found. Open Event Viewer on the affected domain controller and locate that event to see its full text, which carries the detail the alert cannot — the partner, the partition and the underlying error.
4. Confirm against replication itself. Run the same command the Replication Status test uses, to establish whether replication is currently failing or whether the event was a transient condition that has since cleared:
Repadmin /showreplA healthy result shows "Last attempt … was successful" for every inbound neighbour across all partitions — domain, Configuration, Schema, DomainDnsZones and ForestDnsZones.
Common warning or error results, and potential solutions
| Result | Potential solution |
| A replication event has been found | Open the named event in Event Viewer on that domain controller. The event text identifies the replication partner and the underlying failure, which is what determines the fix. |
| AD Events reports a problem but Replication Status is green | Not a contradiction. Windows logged a replication condition that is not currently causing attempts to fail — either it has cleared, or it is a warning ahead of a failure. Check the event timestamp against the last successful replication attempt. |
| Replication Status is failing but no events are reported | Work from Replication Status and Repadmin /showrepl. Not every replication failure produces one of the monitored event IDs. |
| The same event recurs repeatedly | Recurrence matters more than a single occurrence. A replication event that appears each cycle points at a persistent problem with a specific partner or partition rather than a transient one. |
| No AD Events indicator for a Read-Only Domain Controller | Expected. AD Events is the only monitoring feature not supported on RODCs. |
| Results look stale | Compare the monitoring page against NetworkAgentMessage.xml on the web server and the client cache on the domain controller. If the two disagree, the collection has not completed. |
Related monitoring tests
These appear alongside AD Events under AD Replication:
- Replication Status — whether replication attempts are currently succeeding.
- Diagnostics — replication diagnostic detail.
- DFS Replication — SYSVOL and DFS replication, monitored both through Windows events and through a real-time file replication test.
Comments
0 comments
Please sign in to leave a comment.