4929 Security log · DS Access low severity low volume

SecurityEvent
| where EventID == 4929   // An Active Directory replica source naming context was removed
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:Security" EventCode=4929
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# An Active Directory replica source naming context was removed — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Hunt event 4929 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

4662 An operation was performed on an object 4928 An Active Directory replica source naming context was established 4930 An Active Directory replica source naming context was modified 4932 Synchronization of a replica of an Active Directory naming context has begun 4933 Synchronization of a replica of an Active Directory naming context has ended 4934 Attributes of an Active Directory object were replicated 4935 Replication failure begins 4936 Replication failure ends 4937 A lingering object was removed from the replica 5136 A directory service object was modified 5137 A directory service object was created 5138 A directory service object was undeleted