4936 Replication failure ends
Written when an Active Directory replication failure is resolved. Paired with the start 4935, it captures the end of a fault.
Overview
The subcategory is Audit Detailed Directory Service Replication. It is generated when a failing replication recovers. Paired with the start 4935, it lets you bound the fault interval.
How it is triggered
- When a failing DC-to-DC replication recovers.
Security review points
- It indicates the end of a fault. Using the correspondence with the start 4935, understand how long replication was down. Check whether directory synchronization delay or inconsistency arose during that time.
- If faults are frequent or prolonged, investigate the cause (communication, authentication, deliberate disruption).
Notes for log review
- Read it paired with the start 4935 to evaluate the fault’s duration and frequency.
- Use it for operational monitoring of replication health.
Key fields
| Field | Meaning |
|---|---|
| Source/destination DC | The parties to the recovered replication |
Naming Context | The target partition |