Warnings in directory service, ID: 1265, NTDS KCC, every 15 minutes

[MrStack]

This one has been a stumper for me for a month. I have 3 servers, SERVER1 is the file server/mail server/internet connection, SERVER2 is our accounting database, and SERVER3 is an older computer that we use as a dynamic backup for the active directory (it just sits in a closet).
I am getting similar warning messages every 15 minutes on all three servers in the directory service event log. They are as follows:

Message 1 -------
Event Type: Warning
Event Source: NTDS KCC
Event Category: Knowledge Consistency Checker
Event ID: 1265
Date: 11/21/2001
Time: 9:27:01 AM
User: N/A
Computer: SERVER2
Description:
The attempt to establish a replication link with parameters

Partition: CN=Schema,CN=Configuration,DC=CUECO,DC=com
Source DSA DN: CN=NTDS Settings,CN=SERVER1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=CUECO,DC=com
Source DSA Address: 2aad5683-57db-475a-9a71-140bf28a2766._msdcs.CUECO.COM
Inter-site Transport (if any):

failed with the following status:
The DSA operation is unable to proceed because of a DNS lookup failure.
The record data is the status code. This operation will be retried.
Data:
0000: 4c 21 00 00 L!..

Message 2 -------
Event Type: Warning
Event Source: NTDS KCC
Event Category: Knowledge Consistency Checker
Event ID: 1265
Date: 11/21/2001
Time: 9:27:01 AM
User: N/A
Computer: SERVER2
Description:
The attempt to establish a replication link with parameters

Partition: CN=Configuration,DC=CUECO,DC=com
Source DSA DN: CN=NTDS Settings,CN=SERVER1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=CUECO,DC=com
Source DSA Address: 2aad5683-57db-475a-9a71-140bf28a2766._msdcs.CUECO.COM
Inter-site Transport (if any):

failed with the following status:
The DSA operation is unable to proceed because of a DNS lookup failure.
The record data is the status code. This operation will be retried.
Data:
0000: 4c 21 00 00 L!..

Message 3 -------
Event Type: Warning
Event Source: NTDS KCC
Event Category: Knowledge Consistency Checker
Event ID: 1265
Date: 11/21/2001
Time: 9:27:01 AM
User: N/A
Computer: SERVER2
Description:
The attempt to establish a replication link with parameters

Partition: DC=CUECO,DC=com
Source DSA DN: CN=NTDS Settings,CN=SERVER1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=CUECO,DC=com
Source DSA Address: 2aad5683-57db-475a-9a71-140bf28a2766._msdcs.CUECO.COM
Inter-site Transport (if any):

failed with the following status:
The DSA operation is unable to proceed because of a DNS lookup failure.
The record data is the status code. This operation will be retried.
Data:
0000: 4c 21 00 00 L!..

The messages appear in threes, as shown. The only differences between the sets of messages is in the Settings line and the Source DSA address.

On SERVER1 there is one set of 3 messages:
The Settings line shows CN=SERVER3 and the Source DSA Address line shows 5c328f53-3980-4060-acd2-362a517662c8._msdcs.CUECO.COM

On SERVER2, there are two sets of 3 messages:
SET 1: the Settings line shows CN=SERVER1 and the Source DSA Address line shows 2aad5683-57db-475a-9a71-140bf28a2766._msdcs.CUECO.COM
SET 2: the Settings line shows CN=SERVER3 and the Source DSA Address line shows 5c328f53-3980-4060-acd2-362a517662c8._msdcs.CUECO.COM

On SERVER3 there is one set of 3 messages:
The Settings line shows CN=SERVER1 and the Source DSA Address line shows 2aad5683-57db-475a-9a71-140bf28a2766._msdcs.CUECO.COM

The Microsoft Knowledgebase and TechNet have not been very helpful in providing information about the Knowledge Consistency Checker. Is anyone familiar with this type of message, and can anyone tell me how to clear it up? Any enlightenment would be greatly appreciated.

- Mike X-)

 

[mcsebob]

I have had messages similiar to yours, every 15 minutes, in three's, etc. In my case it was a bad group policy that was trying to be replicated to all other DC's. Once I deleted the bad group policy, eveything wrked and the messaged cleared up. However, I do not think this is the case for your messages, how are your DC configured with respects to DNS on the NIC. Be sure that your primary DNS server points to its own IP for DNS, also make sure all other DC's point to your Primary DNS servers IP for DNS. Run IPCONFIG /ALL to find out what your current Ip setting are to aide you in making these changes. Good luck!