Avatar of nmmcfk
nmmcfk
Flag for United States of America asked on

FRS Event ID 13568

Hi all,

I recently promoted a 2008 server in my 2003 AD to act as a redundant DC. Everything went fine during the promotion and all but I have a problem with my file replication. On my original 2003 server DC, I get the event ID 13568:

Event Type:      Error
Event Source:      NtFrs
Event Category:      None
Event ID:      13568
Date:            2/23/2010
Time:            6:31:07 AM
User:            N/A
Computer:      NMMC-DC
Description:
The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR.
 
 Replica set name is    : "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
 Replica root path is   : "c:\windows\sysvol\domain"
 Replica root volume is : "\\.\C:"
 A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found.  This can occur because of one of the following reasons.
 
 [1] Volume "\\.\C:" has been formatted.
 [2] The NTFS USN journal on volume "\\.\C:" has been deleted.
 [3] The NTFS USN journal on volume "\\.\C:" has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.
 [4] File Replication Service was not running on this computer for a long time.
 [5] File Replication Service could not keep up with the rate of Disk IO activity on "\\.\C:".
 Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.
 [1] At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run "net stop ntfrs" followed by "net start ntfrs" to restart the File Replication Service.
 [2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.
 
WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.
 
To change this registry parameter, run regedit.
 
Click on Start, Run and type regedit.
 
Expand HKEY_LOCAL_MACHINE.
Click down the key path:
   "System\CurrentControlSet\Services\NtFrs\Parameters"
Double click on the value name
   "Enable Journal Wrap Automatic Restore"
and update the value.
 
If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.




And my 2008 server obviously I get Event ID's that the RFS does not replicate. Event ID 13508:


Log Name:      File Replication Service
Source:        NtFrs
Date:          2/23/2010 6:33:20 AM
Event ID:      13508
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      FILE-BK.NMMC-NET.local
Description:
The File Replication Service is having trouble enabling replication from nmmc-dc.NMMC-NET.local to FILE-BK for c:\windows\sysvol\domain using the DNS name nmmc-dc.NMMC-NET.local. FRS will keep retrying.
 Following are some of the reasons you would see this warning.
 
 [1] FRS can not correctly resolve the DNS name nmmc-dc.NMMC-NET.local from this computer.
 [2] FRS is not running on nmmc-dc.NMMC-NET.local.
 [3] The topology information in the Active Directory Domain Services for this replica has not yet replicated to all the Domain Controllers.
 
 This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="NtFrs" />
    <EventID Qualifiers="32768">13508</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2010-02-23T11:33:20.000Z" />
    <EventRecordID>98</EventRecordID>
    <Channel>File Replication Service</Channel>
    <Computer>FILE-BK.NMMC-NET.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>nmmc-dc.NMMC-NET.local</Data>
    <Data>FILE-BK</Data>
    <Data>c:\windows\sysvol\domain</Data>
    <Data>nmmc-dc.NMMC-NET.local</Data>
    <Binary>D5040000</Binary>
  </EventData>
</Event>



Thanks in advance
Windows Server 2003Windows Server 2008

Avatar of undefined
Last Comment
nmmcfk

8/22/2022 - Mon
NJComputerNetworks

You might have a DNS problem.

1) check to make sure that all servers and clients are using Internal DNS servers (not ISP or Internet DNS servers) listed in thier TCP/IP properties -- DNS tab

2) Use NSLOOKUP command line tool to verify that network resolution is working on the client machines.  In your case, use this tool on the DC's to make sure DNS resolution is working.'

Also, you might want to check you 2008 DC and verify that the FRS service is started.  (services.msc)
NJComputerNetworks

nmmcfk

ASKER
NSLOOKUP works on both DC .... FRS is also started on te 2008 server. THE DNS entries are all set the these server also. I am not quite updating all the cleints but I dont see why this would cause the FRS to not work ??
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy
NJComputerNetworks

how many DNS servers do you have?  Can you describe your DNS and DC setup a little more?  How many sites?
nmmcfk

ASKER
I have only 1 site with 2 DNS servers 2 DC .... 1 is the original 2003 server and the other one is the 2008 server I want to setup as a redundant server.
NJComputerNetworks

Point all DNS (TCP/IP properties) on both server to the original  2003 server.  (for now, don't put in an alternate... just the origanal server).

Reboot both servers... starting with the 2003 original server... after it completes the boot... reboot the windows 2008 servers.

Check again for errors.
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
nmmcfk

ASKER
OK I will have to wait tomorrow morning to reboot them .......
abolinhas

nmmcfk

ASKER
Tried that and still generating the same errors ......
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
abolinhas

you change the BurFlags value on regedit ?
nmmcfk

ASKER
No ...... I red that it could cause a lot of problems .....
abolinhas

Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
nmmcfk

ASKER
I am confused with D2 and D4 .......
abolinhas

nmmcfk

ASKER
As I am reading this ....It is almost like I need another DC to replicate from but the errors are my main DC that is in production right now ....
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes
abolinhas

Ok, try this

In your dc go to regedit

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\NtFrs\Parameters\Backup/Restore\Process at Startup:

and change the BurFlags value to D4 hex
nmmcfk

ASKER
Is it going to wipe out my sysvol and bring down my DC ???
nmmcfk

ASKER
I think i will wait tomorrow morning to do it ... that way It will give me more time to fix any issues ....
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
abolinhas

nmmcfk

ASKER
See this documents says to use D2 and you said to use D4 .....
abolinhas

my mistake

first try use the d2, if don't work use d4

D2:
Nonauthoritative restores are the most common way to reinitialize individual members of FRS replica sets that are having difficulty. These difficulties may include:
Assertions in the FRS service
Corruption of the local jet database
Journal wrap errors
FRS replication failures

D4:
Use authoritative restores only as a final option, such as in the case of directory collisions.

For example, you may require an authoritative restore if you must recover an FRS replica set where replication has completely stopped and requires a rebuild from scratch.
This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23
nmmcfk

ASKER
I did that and now my outlook client can't connect .... it prompts for a password ??
nmmcfk

ASKER
Looks like my exchange server stop reponding with my DC ...... not good at all .....
abolinhas

you restart the FRS service ?
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
nmmcfk

ASKER
Yes I did and now the exchange server services stop reponding on my excnahge server .....
nmmcfk

ASKER
The replication still does not work also .....
nmmcfk

ASKER
I get this error in the Event viewer ........

Event Type:      Warning
Event Source:      NtFrs
Event Category:      None
Event ID:      13508
Date:            2/25/2010
Time:            7:49:48 AM
User:            N/A
Computer:      NMMC-DC
Description:
The File Replication Service is having trouble enabling replication from FILE-BK to NMMC-DC for c:\windows\sysvol\domain using the DNS name FILE-BK.NMMC-NET.local. FRS will keep retrying.
 Following are some of the reasons you would see this warning.
 
 [1] FRS can not correctly resolve the DNS name FILE-BK.NMMC-NET.local from this computer.
 [2] FRS is not running on FILE-BK.NMMC-NET.local.
 [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers.
 
 This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00               ....    
Your help has saved me hundreds of hours of internet surfing.
fblack61
nmmcfk

ASKER
what does that D2 and D4 does anyway ......
ASKER CERTIFIED SOLUTION
abolinhas

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
nmmcfk

ASKER
Why did my exchange services wont start ... it is almost like the domain doesnt exist for them ......
abolinhas

on your exchange server go to event view and search for errors
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
nmmcfk

ASKER
Now I am rebooting the DC and it is stuck on Preparing Network Connections for the last 15 minutes ....
nmmcfk

ASKER
My DC wont boot up ..... not good at all ....
nmmcfk

ASKER
It is almost like the domain does not exist anymore .......
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck
abolinhas

your server has started ?
nmmcfk

ASKER
It is up but i cant see the AD ......
nmmcfk

ASKER
nobody csnt authenticate to the DC / AD ......
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
nmmcfk

ASKER
This look like somthing si milar to what we have here .... do you think we should try this ???


OK, so here is the summary of what went wrong, why it went wrong, and how MS fixed it for me:

When I added the new DC, the existing DC was already in a "Journal Wrap" state. This is what stopped it replicating to the new DC.

The fix for Journal Wrap described in the event viewer is to copy all the sysvol files, and then perform an "non-authoritative restore" - basically replicating from another DC.

Unfortunately, because my DC was the only DC with a sysvol, it couldn't do this, so it just crapped out.

The fix from Microsoft Support was to copy the two folders (policies/scripts) back from  C:\windows\sysvol\sysvol\TIS.local\NtFrs_PreExisting___See_EventLog to the C:\windows\sysvol\sysvol\TIS.local\ folder, then stop the NTFRS service, then set the BurFlags key to D4, which does an Authoritative restore.

Bingo, my sysvol and netlogon are back, the Journal Wrap error is gone and we have replication over to the new DC - too easy.

He pointed me at this for future refernece:

http://support.microsoft.com/kb/290762

In some ways I feel bad for panicking and not working it out myself, but in other ways I don't.

When you do the Journal Wrap Fix/Non-Authoritative restore, there is nothing to tell you clearly that is has all failed.

All the articles on the D4 Authoritative Restore are quite scary, and I was worried I was just going to make things worse.

I am just glad MS had my back!

A
nmmcfk

ASKER
I fixed it with the last articles ......
abolinhas

now what is the point of situation ?
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy
nmmcfk

ASKER
Now it looks like the solution the article above suggested..... restoring theses 2 files and do a D4 fixed everything ... even the replication between the 2 DC's ....

Thank you very much for your help and also thanks to Arrowtech .....
nmmcfk

ASKER
It is resolved