How to Determine if Full Synchronizations Are Caused By Wrapping the Change Log

There may be situations where you want to determine why backup domain controllers (BDCs) request full synchronizations.

Full synchronizations can be caused by several things:

• Using the Portuas tool
• Using the Nltest tool
• Using the net accounts /sync command
• Wrapping the change log

The only item above that can occur by itself is wrapping the change log. You can use the checked build of the Netlogon.dll file to determine if the change log was wrapped.

To log enough information to determine if the change log was wrapped, set the following parameter in the registry: The following lines show that a full synchronization was caused by wrapping the change log: The first line represents a particular BDC requesting all new changes. In this example, the BDC had changes up to 0 7c7d, or the first 31,869 changes to the Security Accounts Manager (SAM).

The second line shows that the requested delta is no longer in the change log. The primary domain controller (PDC) ignores the partial request and tells that BDC to request a full synchronization.

You can change the size of the change log from 64 KB to 4.19 MB. Each change averages 32 bytes, so the change log can store approximately 2,000-130,000 changes.

To change the size of the change log:

1. Start Registry Editor (Regedit.exe).
2. Locate the following registry key:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetLogon\Parameters
3. On the Edit menu, click Add Value, and add the following value:
   Value Name: ChangeLogSize
   Data Type: REG_DWORD
   String: 0x400000 (hex)