4931 An Active Directory replica destination naming context was modified
Written when an Active Directory replica destination naming context is modified. It captures setting changes on the side that receives replication.
Overview
The subcategory is Audit Detailed Directory Service Replication. It is generated when the naming context settings as a replication recipient (destination) are changed. Whereas 4930 is the source side, this indicates a change on the destination side.
How it is triggered
- When the destination-side partition settings are updated due to a replication topology change.
Security review points
- Destination setting changes are also normally part of topology operations. Confirm an unexpected change as alteration of the replication-receiving path.
- Track configuration changes together with the source side 4930 and establishment 4928.
Notes for log review
- Detailed replication auditing produces high volume. Narrow it to investigation during topology changes.
- Confirm the change is consistent with the legitimate topology.
Key fields
| Field | Meaning |
|---|---|
| Destination/source info | The parties to the replication relationship |
Naming Context | The target partition |