Microsoft Azure AD Connect service account generates "Irregular Domain Replication Activity Detected" events (4255360)

Every two minutes on the Domain Controller where Azure AD Connect is installed an "Irregular Domain Replication Activity Detected" event is generated by the Change Auditor agent.

Because AD Connect performs a replication request of the domain object with the same source/target Domain Controller, Change Auditor detects this as an irregular replication activity.

Workaround:

1. Via the Change Auditor client, create an Excluded Account template
2. Add the "Irregular domain replication activity detected" event class
3. Via the AD object picker locate the AD Connect service account and add it to list of excluded accounts
4. Complete/Finish the wizard
5. Add the Excluded Account template to the Configuration assigned to the Domain Controller where AD Connect is deployed
6. The changes will take effect automatically within 15 minutes (by default)

Status:

• An Enhancement Request (230776) has been submitted for consideration in a future release of Change Auditor.