errors with dcdiag on our domain servers - ncsecdesc is failing

ncsecdesc is failing
Error: Domain\Enterprise Read-only domain controllers doesn't have replicating directory changes
both domain servers are failing on this
DC1 is a Windows 2012R2 server
DC2 is a Windows 2019 server

any idea what is going on and how to fix this?