asked on

Active Directory FRS error 13508 in FRS Event Log

Well I have been working on this problem for awhile now and I just can't seem to figure it out.

Here is what is going on:

A couple of weeks ago as I was doing some research into replacing some of my aging DCs I came across an error that I can't seem to remedy. I was running DCDIAG just to check and make sure there wasn't any errors and I found one. All tests would pass except the Netlogons test and the FRSEvent test when running DCDIAG.

I get the following output for this test:
Starting test: NetLogons
* Network Logons Privileges Check
Unable to connect to the NETLOGON share! (\\SERVER\netlogon)
[SERVER] An net use or LsaPolicy operation failed with error 1203, No network provider accepted the given network path..
......................... SERVER failed test NetLogons

I also fail the FRSEVENT test with the error:
Starting test: frsevent
* The File Replication Service Event log test
There are warning or error events within the last 24 hours after the

SYSVOL has been shared. Failing SYSVOL replication problems may cause

Group Policy problems.
An Warning Event occured. EventID: 0x800034C4
Time Generated: 08/23/2010 22:49:31
(Event String could not be retrieved)
......................... SERVER failed test frsevent

So I did some research and was directed towards the FRS Event Logs. Once I looked in there I saw the following error:
The File Replication Service is having trouble enabling replication from <server> to <server> for <path> using the DNS name <name>. FRS will keep retrying.
Following are some of the reasons you would see this warning.

[1] FRS can not correctly resolve the DNS name <name> from this computer.
[2] FRS is not running on <name>.
[3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers.

This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.

I found the following ideas to fix this:
https://www.experts-exchange.com/questions/21740439/FILE-REPLICATION-SERVICE-is-having-trouble-Event-ID-13508.html

I have tried the steps outlined towards the bottom of that thread from malboteju and iistech. I tried changing that value to D2 and D4 and each time for just a couple minutes I almost thought that it worked. I recieved the following event in my FRS log immediately after restarting the FRS service:
The File Replication Service is no longer preventing the computer <SERVER> from becoming a domain controller. The system volume has been successfully initialized and the Netlogon service has been notified that the system volume is now ready to be shared as SYSVOL.

Type "net share" to check for the SYSVOL share.

Then about 2 minutes later that 13508 error comes back.

Looking at the Shares in Computer Management I only see SYSVOL and not NETLOGON.

So obviously something still isn't working with FRS but I haven't been able to find what it is.

I have this same problem on my other DC as well. So 2 of my 3 DCs have this exact same problem and I have followed the same troubleshooting steps for both.

The FRS log for the 1 "working" server doesn't have any errors listed and has both a SYSVOL and NETLOGON share listed.

I also ran FRSDiag and it came back with the following:
------------------------------------------------------------
FRSDiag v1.7 on 8/23/2010 10:38:11 AM
.\SERVER on 2010-08-23 at 10.38.11 AM
------------------------------------------------------------

Checking for errors/warnings in FRS Event Log .... 	
NtFrs	8/22/2010 9:45:03 PM	Warning	13508	The File Replication Service is having trouble enabling replication from SERVER to SERVER for c:\windows\sysvol\domain using the DNS name SERVER.DOMAIN.com. FRS will keep retrying. Following are some of the reasons you would see this warning. [1] FRS can not correctly resolve the DNS name SERVER.DOMAIN.com from this computer. [2] FRS is not running on SERVER.DOMAIN.com. [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers. This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.	
NtFrs	8/21/2010 6:39:37 PM	Warning	13508	The File Replication Service is having trouble enabling replication from SERVER to SERVER for c:\windows\sysvol\domain using the DNS name SERVER.DOMAIN.com. FRS will keep retrying. Following are some of the reasons you would see this warning. [1] FRS can not correctly resolve the DNS name SERVER.DOMAIN.com from this computer. [2] FRS is not running on SERVER.DOMAIN.com. [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers. This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.	
NtFrs	8/20/2010 5:22:41 PM	Warning	13508	The File Replication Service is having trouble enabling replication from SERVER to SERVER for c:\windows\sysvol\domain using the DNS name SERVER.DOMAIN.com. FRS will keep retrying. Following are some of the reasons you would see this warning. [1] FRS can not correctly resolve the DNS name SERVER.DOMAIN.com from this computer. [2] FRS is not running on SERVER.DOMAIN.com. [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers. This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.
	WARNING: Found Event ID 13508 errors without trailing 13509 ... see above for (up to) the 3 latest entries!

......... failed 1
Checking for errors in Directory Service Event Log .... passed
Checking for minimum FRS version requirement ... passed
Checking for errors/warnings in ntfrsutl ds ... passed
Checking for Replica Set configuration triggers... passed
Checking for suspicious file Backlog size... passed
Checking Overall Disk Space and SYSVOL structure (note: integrity is not checked)... passed
Checking for suspicious inlog entries ... passed
Checking for suspicious outlog entries ... passed
Checking for appropriate staging area size ... passed
Checking for errors in debug logs ...
	ERROR on NtFrs_0005.log : "ERROR_ACCESS_DENIED" : <SndCsMain: 5244: 904: S0: 10:31:27> :SR: Cmd 01744da0, CxtG 6f08502c, WS ERROR_ACCESS_DENIED, To SERVER.DOMAIN.com Len: (362) [SndFail - Send Penalty]
	ERROR on NtFrs_0005.log : "ERROR_ACCESS_DENIED" : <SndCsMain: 5244: 877: S0: 10:36:27> :SR: Cmd 017484b8, CxtG 6f08502c, WS ERROR_ACCESS_DENIED, To SERVER.DOMAIN.com Len: (362) [SndFail - rpc call]
	ERROR on NtFrs_0005.log : "ERROR_ACCESS_DENIED" : <SndCsMain: 5244: 904: S0: 10:36:27> :SR: Cmd 017484b8, CxtG 6f08502c, WS ERROR_ACCESS_DENIED, To SERVER.DOMAIN.com Len: (362) [SndFail - Send Penalty]
	ERROR on NtFrs_0003.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was established to target, but there was a failure to send RPC call package. Check for Networking problems!)" : <SndCsMain: 5512: 884: S0: 16:28:20> :SR: Cmd 0143ff68, CxtG 075b2240, WS RPC_S_CALL_FAILED_DNE, To dc-1.DOMAIN.com Len: (362) [SndFail - rpc exception]
	ERROR on NtFrs_0003.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was established to target, but there was a failure to send RPC call package. Check for Networking problems!)" : <SndCsMain: 5512: 883: S0: 16:28:36> ++ ERROR - EXCEPTION (000006bf) : WStatus: RPC_S_CALL_FAILED_DNE
	ERROR on NtFrs_0003.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was established to target, but there was a failure to send RPC call package. Check for Networking problems!)" : <SndCsMain: 5512: 884: S0: 16:28:36> :SR: Cmd 01454a00, CxtG 075b2240, WS RPC_S_CALL_FAILED_DNE, To dc-1.DOMAIN.com Len: (462) [SndFail - rpc exception]

	Found 7906 ERROR_ACCESS_DENIED error(s)! Latest ones (up to 3) listed above
	Found 4 RPC_S_CALL_FAILED_DNE error(s)! Latest ones (up to 3) listed above

......... failed with 7910 error entries
Checking NtFrs Service (and dependent services) state...
	ERROR : Cannot access NETLOGON share on SERVER
......... failed 1
Checking NtFrs related Registry Keys for possible problems...passed
Checking Repadmin Showreps for errors...passed

I also tried something regarding a JOURNAL WRAP registry key but FRSDIAG came back and said that shouldn't be used anymore.

The ERROR_ACCESS_DENIED error from the FRSDIAG leads me to believe that this could be a permissions issue either on a share or directory but if it is I am not sure what permissions I am missing.

I inherited this domain and I have not added any new domain controllers or removed any old ones since I have been working with it, not sure if that information is needed but it might answer some questions before someone asks them.

Also, regarding the D2 and D4 registry entries. Should I be doing this on the working server too? I only tried changing those keys on the servers that have the FRS errors in their event logs but I haven't tried it on the "working server". From the information I have read so far it doesn't seem like I would need to but I just want to make sure.

Thanks in advance for your help. Let me know if you need more information and I will try and provide as much of it as I can.

ChiefIT

go to the faild DC and type:

DCdiag /test:DNS

Please provide this data

snusgubben

You should *not* set the burflags to D4 on the DC that is missing the Netlogon share. You'll then say that this DC holds the authoritative SYSVOL even if it's missing the Netlogon.