Solved

NTFRS error in event log with event ID 13559

Posted on 2004-04-05
7
10,563 Views
Last Modified: 2010-01-11
One of the production servers I support started showing the following error in the File Replication Service Log (only when the service starts):

The File Replication Service has detected that the replica root path has changed from "c:\winnt\sysvol\domain" to "c:\winnt\sysvol\domain". If this is an intentional move then a file with the name NTFRS_CMD_FILE_MOVE_ROOT needs to be created under the new root path.
This was detected for the following replica set:
    "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
 
Changing the replica root path is a two step process which is triggered by the creation of the NTFRS_CMD_FILE_MOVE_ROOT file.
 
 [1] At the first poll which will occur in 5 minutes this computer will be deleted from the replica set.
 [2] At the poll following the deletion this computer will be re-added to the replica set with the new root path. This re-addition will trigger a full tree sync for the replica set. At the end of the sync all the files will be at the new location. The files may or may not be deleted from the old location depending on whether they are needed or not.

I have not made any changes to the system.  This server is Windows 2000 SP-4 with SQL server 2000 SP-3a & Exchange Server 2003.  I have researched the following Microsoft KB articles and tried the fixes without success (819268 & 291823).  Is this an error to be concerned about?  This is the only domain controller on the network.  The other servers are a Terminal server, mail/virus scanning server and a proxy server for a VPN to another office.  Do we even need file replication service running?

Thanks for your assistance.

Roy Brotherhood
0
Comment
Question by:rbrother
7 Comments
 
LVL 31

Expert Comment

by:Gareth Gudger
ID: 10759832
0
 

Author Comment

by:rbrother
ID: 10760475
I have tried both of these fixes without any effect.
0
 
LVL 3

Accepted Solution

by:
following earned 500 total points
ID: 10760687
Sorry to ask the obvious, but did you actually create the NTFRS_CMD_FILE_MOVE_ROOT file in "C:\winnt\sysvol\domain"?  Whatever triggered it to think there was a change might be able to get itself back on track if you create this file.

An interesting post that may help explain:

http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&th=a31701be4c7228ab&seekm=O4%23PlkGsDHA.2416%40TK2MSFTNGP10.phx.gbl&frame=off

Hope this helps,
-jdm
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 

Author Comment

by:rbrother
ID: 10760789
I did try creating the file, but I just realized that I created it with a .txt extension.  I will give it a try without any extension.

I did try something else that appears to work.  I openend the dfs manager and removed all dfs shares. and then did the following at a command prompt:

copied data from c:\winnt\ntfrs\jet to a safe location
net stop ntfrs
rd /s /q c:\winnt\ntfrs\jet
net start ntfrs
about 10 minutes later I copied the data from step 1 back to the original location.  Then I recreated the dfs shares.  So far no errors in the event log.

I made backup of the server to setup on a duplicate offline machine we use for testing purposes.  I will try your suggestion and create the NTFRS_CMD_FILE_MOVE_ROOT file (without an extension) and see if it works.  I'll let you know.

Thanks,

Roy Brotherhood
0
 

Author Comment

by:rbrother
ID: 10761848
Here is another followup.

After deleting the and recreating the c:\winnt\ntfrs\jet folder in my last posting, I received the following errors one hour later:

Event Type:      Error
Event Source:      NtFrs
Event Category:      None
Event ID:      13539
Date:            04/05/2004
Time:            4:05:48 PM
User:            N/A
Computer:      SERVER
Description:
The File Replication Service cannot replicate c:\winnt\sysvol\domain because the pathname of the replicated directory is not the fully qualified pathname of an existing, accessible local directory.

And then 25 minutes later:

Event Type:      Error
Event Source:      NtFrs
Event Category:      None
Event ID:      13507
Date:            04/05/2004
Time:            4:30:50 PM
User:            N/A
Computer:      SERVER
Description:
The File Replication Service cannot start replica set DOMAIN SYSTEM VOLUME (SYSVOL SHARE) on computer SERVER for directory c:\winnt\sysvol\domain because the type of volume <null> is not NTFS 5.0 or later.
 
The volume's type can be found by typing "chkdsk <null>".
 
The volume can be upgraded to NTFS 5.0 or later by typing "chkntfs /E <null>".

Any ideaa? I am increasing the points on this problem.

Thanks,

Roy Brotherhood

0
 
LVL 1

Expert Comment

by:tobri
ID: 10764294
Hi`Rbrother

there is more troubleshooting here..
http://support.microsoft.com/default.aspx?scid=kb;en-us;272279&sd=tech

MORE INFORMATION
You may observe that FRS has stopped replicating content on your system. This behavior may occur because of many potential causes.

If your system experiences FRS problems, you can perform the following general procedure to troubleshoot these problems:


Check for free disk space on Computer A (source directory, staging directory, and database partition) and Computer B (destination partition, preinstall partition, and database partition). Look for the following events in Event Viewer:
Event id:13511
Database is out of disk space.

Event id:13522
Staging directory is full. An outbound partner that has not connected for a while can cause this. Delete the connection and stop and restart FRS to force deletion of the staging files.


For additional information about how to move the database to a larger volume, click the article number below to view the article in the Microsoft Knowledge Base:
221093 How to Relocate the NTFRS Jet Database and Log Files



Create a test file on Computer B and verify its replication to Computer A.
Verify that both Computer A and Computer B are available on the network. Because FRS uses the fully qualified domain name (FQDN) of the replica members, an appropriate first check is to use a ping command specifying the fully qualified name of the problem replicas.

From Computer A, send a ping command with Computer B's FQDN. From Computer B, send a ping command to Computer A's FQDN. Verify that the addresses returned by the ping command are the same as the addresses returned by an ipconfig /all command by means of the command line of the destination computer.
Access the Services administrative console by following these steps:


Click Start, and then click Run.
In the Open box, type:

services.msc

Confirm that FRS runs on both computers. If the service is not running, review the FRS container of Event Viewer (located in the Eventvwr.msc file) on the computer experiencing the problem.
Verify remote procedure call (RPC) connectivity between Computer A and Computer B. An appropriate test may be to open Event Viewer on Computer B from Computer A (which uses RPC). Check FRS event logs on both computers. If Event ID 13508 is present, there may be a problem with the RPC service on either computer or with creating a secure connection between Computer A and Computer B.
Use the Active Directory Sites and Services console to verify the replication schedule on the Connection object. Ensure that replication is enabled between Computer A and Computer B and that the connection is enabled. The Connection object is the inbound connection under Computer A's NTFRS_MEMBER object from Computer B. For System Volume (SYSVOL), the Connection object resides in the Sites\Site_name\Servers\Server_name\Ntds Settings\Connection_name folder.
For Dfs, view the connection links in Active Directory (AD) Users and Computers. Open AD Users and Computer, click View from the menu and ensure that Advanced Settings are selected. Go to the System container. The location of the Connection objects are in the System\File Replication Service\DFS Volumes folder.
Verify whether or not the file on the originating server is locked (cannot be accessed) on either computer. If the file is locked on Computer B so that FRS cannot read the file, FRS cannot generate the staging file, which delays replication. If the file is locked on Computer A so that FRS cannot update the file, FRS continues to retry the update until it succeeds. The retry interval is 30 to 60 seconds.
Verify whether or not the source file had been excluded from replication. Confirm that the file is not Encrypting File System (EFS) encrypted, a NTFS file system (NTFS) junction, or excluded by a file or folder filter on the originating replica member. If any of these situations are true, FRS does not replicate the file or directory.
If all of the previous conditions are met, you may have to examine the log files that are created for FRS. The log files are located in the %Systemroot%\Debug folder. The file names are listed from NtFrs_001.log to NtFrs_005.log.

Kind regards Tobri !!
0
 

Expert Comment

by:edgetechnology
ID: 22188460
I had the same problem as rbrother in the first post and all I did was to create the file NTFRS_CMD_FILE_MOVE_ROOT (no extension) in the C:\WINDOWS\SYSVOL folder. Then I restarted the File Replication Service.
That seems to have kicked off a recovery process.
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Introduction How to create multiboot configuration with XP\Vista and Windows 7 on it? And most important question - how to do this correctly so not to have any kind of nightmares we get when system gets screwed? First of all one should realize t…
I use more than 1 computer in my office for various reasons. Multiple keyboards and mice take up more than just extra space, they make working a little more complicated. Using one mouse and keyboard for all of my computers makes life easier. This co…
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now