NTFRS error in event log with event ID 13559

Posted on 2004-04-05
Medium Priority
Last Modified: 2010-01-11
One of the production servers I support started showing the following error in the File Replication Service Log (only when the service starts):

The File Replication Service has detected that the replica root path has changed from "c:\winnt\sysvol\domain" to "c:\winnt\sysvol\domain". If this is an intentional move then a file with the name NTFRS_CMD_FILE_MOVE_ROOT needs to be created under the new root path.
This was detected for the following replica set:
Changing the replica root path is a two step process which is triggered by the creation of the NTFRS_CMD_FILE_MOVE_ROOT file.
 [1] At the first poll which will occur in 5 minutes this computer will be deleted from the replica set.
 [2] At the poll following the deletion this computer will be re-added to the replica set with the new root path. This re-addition will trigger a full tree sync for the replica set. At the end of the sync all the files will be at the new location. The files may or may not be deleted from the old location depending on whether they are needed or not.

I have not made any changes to the system.  This server is Windows 2000 SP-4 with SQL server 2000 SP-3a & Exchange Server 2003.  I have researched the following Microsoft KB articles and tried the fixes without success (819268 & 291823).  Is this an error to be concerned about?  This is the only domain controller on the network.  The other servers are a Terminal server, mail/virus scanning server and a proxy server for a VPN to another office.  Do we even need file replication service running?

Thanks for your assistance.

Roy Brotherhood
Question by:rbrother
LVL 31

Expert Comment

by:Gareth Gudger
ID: 10759832

Author Comment

ID: 10760475
I have tried both of these fixes without any effect.

Accepted Solution

following earned 2000 total points
ID: 10760687
Sorry to ask the obvious, but did you actually create the NTFRS_CMD_FILE_MOVE_ROOT file in "C:\winnt\sysvol\domain"?  Whatever triggered it to think there was a change might be able to get itself back on track if you create this file.

An interesting post that may help explain:


Hope this helps,
Receive 1:1 tech help

Solve your biggest tech problems alongside global tech experts with 1:1 help.


Author Comment

ID: 10760789
I did try creating the file, but I just realized that I created it with a .txt extension.  I will give it a try without any extension.

I did try something else that appears to work.  I openend the dfs manager and removed all dfs shares. and then did the following at a command prompt:

copied data from c:\winnt\ntfrs\jet to a safe location
net stop ntfrs
rd /s /q c:\winnt\ntfrs\jet
net start ntfrs
about 10 minutes later I copied the data from step 1 back to the original location.  Then I recreated the dfs shares.  So far no errors in the event log.

I made backup of the server to setup on a duplicate offline machine we use for testing purposes.  I will try your suggestion and create the NTFRS_CMD_FILE_MOVE_ROOT file (without an extension) and see if it works.  I'll let you know.


Roy Brotherhood

Author Comment

ID: 10761848
Here is another followup.

After deleting the and recreating the c:\winnt\ntfrs\jet folder in my last posting, I received the following errors one hour later:

Event Type:      Error
Event Source:      NtFrs
Event Category:      None
Event ID:      13539
Date:            04/05/2004
Time:            4:05:48 PM
User:            N/A
Computer:      SERVER
The File Replication Service cannot replicate c:\winnt\sysvol\domain because the pathname of the replicated directory is not the fully qualified pathname of an existing, accessible local directory.

And then 25 minutes later:

Event Type:      Error
Event Source:      NtFrs
Event Category:      None
Event ID:      13507
Date:            04/05/2004
Time:            4:30:50 PM
User:            N/A
Computer:      SERVER
The File Replication Service cannot start replica set DOMAIN SYSTEM VOLUME (SYSVOL SHARE) on computer SERVER for directory c:\winnt\sysvol\domain because the type of volume <null> is not NTFS 5.0 or later.
The volume's type can be found by typing "chkdsk <null>".
The volume can be upgraded to NTFS 5.0 or later by typing "chkntfs /E <null>".

Any ideaa? I am increasing the points on this problem.


Roy Brotherhood


Expert Comment

ID: 10764294

there is more troubleshooting here..

You may observe that FRS has stopped replicating content on your system. This behavior may occur because of many potential causes.

If your system experiences FRS problems, you can perform the following general procedure to troubleshoot these problems:

Check for free disk space on Computer A (source directory, staging directory, and database partition) and Computer B (destination partition, preinstall partition, and database partition). Look for the following events in Event Viewer:
Event id:13511
Database is out of disk space.

Event id:13522
Staging directory is full. An outbound partner that has not connected for a while can cause this. Delete the connection and stop and restart FRS to force deletion of the staging files.

For additional information about how to move the database to a larger volume, click the article number below to view the article in the Microsoft Knowledge Base:
221093 How to Relocate the NTFRS Jet Database and Log Files

Create a test file on Computer B and verify its replication to Computer A.
Verify that both Computer A and Computer B are available on the network. Because FRS uses the fully qualified domain name (FQDN) of the replica members, an appropriate first check is to use a ping command specifying the fully qualified name of the problem replicas.

From Computer A, send a ping command with Computer B's FQDN. From Computer B, send a ping command to Computer A's FQDN. Verify that the addresses returned by the ping command are the same as the addresses returned by an ipconfig /all command by means of the command line of the destination computer.
Access the Services administrative console by following these steps:

Click Start, and then click Run.
In the Open box, type:


Confirm that FRS runs on both computers. If the service is not running, review the FRS container of Event Viewer (located in the Eventvwr.msc file) on the computer experiencing the problem.
Verify remote procedure call (RPC) connectivity between Computer A and Computer B. An appropriate test may be to open Event Viewer on Computer B from Computer A (which uses RPC). Check FRS event logs on both computers. If Event ID 13508 is present, there may be a problem with the RPC service on either computer or with creating a secure connection between Computer A and Computer B.
Use the Active Directory Sites and Services console to verify the replication schedule on the Connection object. Ensure that replication is enabled between Computer A and Computer B and that the connection is enabled. The Connection object is the inbound connection under Computer A's NTFRS_MEMBER object from Computer B. For System Volume (SYSVOL), the Connection object resides in the Sites\Site_name\Servers\Server_name\Ntds Settings\Connection_name folder.
For Dfs, view the connection links in Active Directory (AD) Users and Computers. Open AD Users and Computer, click View from the menu and ensure that Advanced Settings are selected. Go to the System container. The location of the Connection objects are in the System\File Replication Service\DFS Volumes folder.
Verify whether or not the file on the originating server is locked (cannot be accessed) on either computer. If the file is locked on Computer B so that FRS cannot read the file, FRS cannot generate the staging file, which delays replication. If the file is locked on Computer A so that FRS cannot update the file, FRS continues to retry the update until it succeeds. The retry interval is 30 to 60 seconds.
Verify whether or not the source file had been excluded from replication. Confirm that the file is not Encrypting File System (EFS) encrypted, a NTFS file system (NTFS) junction, or excluded by a file or folder filter on the originating replica member. If any of these situations are true, FRS does not replicate the file or directory.
If all of the previous conditions are met, you may have to examine the log files that are created for FRS. The log files are located in the %Systemroot%\Debug folder. The file names are listed from NtFrs_001.log to NtFrs_005.log.

Kind regards Tobri !!

Expert Comment

ID: 22188460
I had the same problem as rbrother in the first post and all I did was to create the file NTFRS_CMD_FILE_MOVE_ROOT (no extension) in the C:\WINDOWS\SYSVOL folder. Then I restarted the File Replication Service.
That seems to have kicked off a recovery process.

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As the title indicates, I have done this before. It chills me everytime I update the OS on my phone, (http://www.experts-exchange.com/articles/18084/Upgrading-to-Android-5-0-Lollipop.html) because one time I did this and I essentially had a bricked …
Windows 10 is here and for most admins this means frustration and challenges getting that first working Windows 10 image. As in my previous sysprep articles, I've put together a simple help guide to get you through this process. The aim is to achiev…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.

600 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question