NTDS KCC event 1311 indicates an incomplete Active Directory replication topology; check sites, site links and replication errors.
Source of event
NTDS KCC — Active Directory category.
Possible causes
- AD site incorrectly configured
- WAN link cut
- DC unavailable
- DNS
Verifications to be carried out
- Record the partition, domain controller and event time.
- Review failures with repadmin /replsummary and repadmin /showrepl.
- Check that site links connect the required sites and reflect the actual network.
- Verify domain controller availability, DNS resolution and RPC connectivity before making changes.
Commands
repadmin /replsummaryrepadmin /showreplKey takeaways
An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.
What does this error mean?
The Knowledge Consistency Checker cannot build a path covering the required replicas. Interpret event 1311 with the NTDS KCC provider and the complete message.
Separate topology and connectivity failures
A missing site link is a logical configuration problem; an unavailable domain controller or network is an infrastructure failure. Either can produce this symptom.
Validate the recovery
Correct the observed cause, then review replication results and subsequent events. Do not delete connections or force a topology rebuild without understanding the current topology.