Active Directory event IDs: Directory Service, Netlogon and DNS events and their fixes

Domain controllers report most of their problems in three places: the Directory Service log, Netlogon entries in the System log and the DNS Server log. This reference covers the event IDs Microsoft documents for replication and topology, LDAP signing and channel binding, the computer secure channel and AD-integrated DNS zones, with what each one means, the usual cause and the first check.

How to read these events#

• Directory Service log (Applications and Services Logs › Directory Service, on domain controllers): the source is ActiveDirectory_DomainService, and the task category (Replication, Knowledge Consistency Checker, LDAP Interface) matches the older NTDS source names in Microsoft's tables. Errors and warnings here usually name the partner, partition and next step.
• System log, source NETLOGON: secure channel and DC discovery events, on members and on DCs. For detail, turn on Netlogon debug logging with nltest /dbflag:0x2000ffff; it writes %windir%\Debug\Netlogon.log.
• DNS Server log (source Microsoft-Windows-DNS-Server-Service; older articles show "DNS"): zone loading and Active Directory access problems on DCs that run DNS.

A quick health pass on a domain controller:

$since = (Get-Date).AddDays(-1)
foreach ($log in 'Directory Service', 'DNS Server') {
    Get-WinEvent -FilterHashtable @{LogName=$log; Level=2,3; StartTime=$since} -ErrorAction SilentlyContinue |
        Group-Object Id | Sort-Object Count -Descending | Select-Object @{n='Log';e={$log}}, Name, Count
}
repadmin /showrepl * /csv > showrepl.csv
dcdiag /v > dcdiag.txt

Directory Service: replication and topology#

Lingering-object cleanup compares a suspect DC with a good reference DC; run it in advisory mode first, and check the forest's tombstone lifetime:

repadmin /removelingeringobjects <SuspectDC> <ReferenceDC-DSA-GUID> "DC=contoso,DC=com" /advisory_mode
repadmin /regkey * +strict
(Get-ADObject "CN=Directory Service,CN=Windows NT,CN=Services,$((Get-ADRootDSE).configurationNamingContext)" -Properties tombstoneLifetime).tombstoneLifetime

Directory Service: LDAP signing and channel binding#

The daily events (2886, 2887, 3040, 3041) don't name clients. The per-client events (2889, 3039, 3074, 3075) carry the client's IP address and identity, but only after you raise LDAP Interface logging to 2, and 3039, 3074 and 3075 appear only when the channel binding policy is When Supported or Always:

reg add HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics /v "16 LDAP Interface Events" /t REG_DWORD /d 2 /f

The policies map to LDAPServerIntegrity (1 None, 2 Require signing) and LdapEnforceChannelBinding (0 Never, 1 When Supported, 2 Always) under HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters. New Active Directory deployments on Windows Server 2025 require LDAP signing by default, so clients that don't sign fail from day one.

Netlogon: secure channel and domain controller discovery#

Netlogon registers the DC's records at startup, when the service restarts and every hour, so nltest /dsregdns or a Netlogon restart is a fair retest after you fix DNS. If trust failures started after the September 2026 updates, also read Domain trust failures after KB5124008.

DNS Server events on domain controllers#

How to verify a fix#

1. Rerun repadmin /showrepl * /csv: in Excel, filter out deleted DCs and look for any row with a Last Failure Time other than 0. None is the goal.
2. Watch the source event, not just the symptom: 2087 and 2088 stop after the DNS fix; 1988 stops only when lingering objects are gone; 2042 must not come back after the DC replicates again.
3. For LDAP hardening, 2887 and 3040 should stop appearing for several days before you enforce; after enforcement, no 2888 events should appear.
4. On a member that logged 5719 or 3210, Test-ComputerSecureChannel -Verbose returns True and reports that the secure channel is in good condition.
5. For DNS, the zones load in DNS Manager, Get-DnsServerZone lists them, and dcdiag /test:dns passes on every DC.

Related: Kerberos error codes and domain join errors.

References#

• Troubleshooting Active Directory replication problems (events 1311, 1388, 1925, 1988, 2042, 2087, 2088, 5805)
• LDAP channel binding and LDAP signing requirements for Windows (KB4520412)
• Event ID 4015: The DNS server encountered a critical error
• Broken trust relationship between a domain-joined device and its domain