• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 885
  • Last Modified:

File replication Service is not showing up in Services

This computer is a Domain Controller we will call this dc1, it hosts dns. I am having trouble finding the file replication service under the services. i have no idea where it could have gone. I thought this DC1 might have gotten migrated to dfrs, however when i run the command dfsrmig /migrationstate, it tells me that it is only supported on server 2008. DC2 is hosting dns, dhcp and is running server 2003 r2. The servers are showing that replication is working fine. When i run net stop ntfrs on either server i get the following messing: system error5 has occurred. Access is denied.
0
wtcs
Asked:
wtcs
  • 17
  • 11
  • +2
1 Solution
 
salaskidCommented:
try running in elevated command prompt
0
 
wtcsAuthor Commented:
i have tried that with no luck.
0
 
snusgubbenCommented:
Open registry and see if you spot the NTFRS service under HKLM\System\CCS\Services
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
anantshahCommented:
Can you run File Replication Service Diagnostics Tool (FRSDiag.exe) and post the results.

http://www.microsoft.com/downloads/en/details.aspx?FamilyId=43CB658E-8553-4DE7-811A-562563EB5EBF&displaylang=en
0
 
wtcsAuthor Commented:
1.) ntfrs service was not listed under hklm\system\services

2.) i will post the results of frsdiag.exe shortly, i will have to step away for a few hours this sunday morning.

thanks
0
 
wtcsAuthor Commented:
which log do i need to post and where do i find it?
0
 
snusgubbenCommented:
Do you see the ntfrs.exe in task manager?
0
 
wtcsAuthor Commented:
yes i do see the ntfrs.exe in task manager.
0
 
snusgubbenCommented:
1.) ntfrs service was not listed under hklm\system\services

Did you look at HKLM\System\CurrentConrtolSet\Services\NtFrs?

If you ran FRSDiag. Attach the file called "ntfrs_reg.txt" and "connstat.txt"
0
 
wtcsAuthor Commented:
i did see ntfrs, and i will post the results,
0
 
wtcsAuthor Commented:

============================================
HKLM\SYSTEM\CurrentControlSet\Services\NtFrs
============================================

SYSTEM\CurrentControlSet\Services\NtFrs
      Type = 16
      Start = 2
      ErrorControl = 0
      ImagePath = C:\Windows\system32\ntfrs.exe
      DisplayName = File Replication Service
      DependOnService = System.String[]
      ObjectName = LocalSystem
      Description = @ntfrsres.dll,-131
      ServiceSidType = 1
      RequiredPrivileges = System.String[]
      FailureActions = System.Byte[]
      Group =
      SYSTEM\CurrentControlSet\Services\NtFrs\Parameters
            Working Directory = C:\Windows\ntfrs
            File Inclusion Filter List =
            Mutual authentication is [Enabled or Disabled] = Default (Enabled)
            Staging Space Limit in KB = 675840
            SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Access Checks
                  SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Access Checks\dcpromo
                        Access checks are [Enabled or Disabled] = Default (Enabled)
                        Access checks require [Full Control or Read] = Default (Full Control)
                  
                  SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Access Checks\Force Replication
                        Access checks are [Enabled or Disabled] = Default (Enabled)
                        Access checks require [Full Control or Read] = Default (Full Control)
                  
                  SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Access Checks\Get Ds Polling Interval
                        Access checks are [Enabled or Disabled] = Default (Enabled)
                        Access checks require [Full Control or Read] = Default (Read)
                  
                  SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Access Checks\Get Internal Information
                        Access checks are [Enabled or Disabled] = Default (Enabled)
                        Access checks require [Full Control or Read] = Default (Full Control)
                  
                  SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Access Checks\Get Perfmon Data
                        Access checks are [Enabled or Disabled] = Default (Enabled)
                        Access checks require [Full Control or Read] = Default (Read)
                  
                  SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Access Checks\Is Path Replicated
                        Access checks are [Enabled or Disabled] = Default (Enabled)
                        Access checks require [Full Control or Read] = Default (Read)
                  
                  SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Access Checks\Set Ds Polling Interval
                        Access checks are [Enabled or Disabled] = Default (Enabled)
                        Access checks require [Full Control or Read] = Default (Full Control)
                  
                  SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Access Checks\Start Ds Polling
                        Access checks are [Enabled or Disabled] = Default (Enabled)
                        Access checks require [Full Control or Read] = Default (Full Control)
                  
                  SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Access Checks\Writer Commands
                        Access checks are [Enabled or Disabled] = Default (Enabled)
                        Access checks require [Full Control or Read] = Default (Full Control)
                  
            
            SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore
                  SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup
                        BurFlags = 0
                        SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup\Cumulative Replica Sets
                        
                        SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup\Replica Sets
                        
                  
            
            SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Cumulative Replica Sets
                  SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Cumulative Replica Sets\a05bb491-b3a1-4835-acaf17dc6fbec3df
                        Number Of Partners = 2
                        BurFlags = 0
                  
            
            SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Replica Sets
                  Database Directory = c:\windows\ntfrs\jet
                  SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Replica Sets\a05bb491-b3a1-4835-acaf17dc6fbec3df
                        Replica Set Name = DOMAIN SYSTEM VOLUME (SYSVOL SHARE)
                        Replica Set Root = c:\windows\sysvol\domain
                        Replica Set Stage = c:\windows\sysvol\staging\domain
                        Replica Set Type = Domain
                        Replica Set Tombstoned = 0
                  
            
            SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\SysVol
            
            SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\SysVol Seeding
            
      
      SYSTEM\CurrentControlSet\Services\NtFrs\Security
            Security = System.Byte[]
      
      SYSTEM\CurrentControlSet\Services\NtFrs\Enum
            0 = Root\LEGACY_NTFRS\0000
            Count = 1
            NextInstance = 1
      

==========================================================
HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
==========================================================

SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
      Update = no
      disablepasswordchange = 0
      maximumpasswordage = 30
      requiresignorseal = 1
      requirestrongkey = 0
      sealsecurechannel = 1
      signsecurechannel = 1
      DynamicSiteName = Default-First-Site-Name
      SysvolReady = 1
      SysVol = C:\Windows\SYSVOL\sysvol
0
 
wtcsAuthor Commented:
connstat.txt did not have any information.
0
 
snusgubbenCommented:
Was connstat.txt empty?
0
 
wtcsAuthor Commented:
it was empty
0
 
snusgubbenCommented:
Can you post the "NTFRS_SETS.TXT" file from the FRSDiag?
0
 
wtcsAuthor Commented:

ACTIVE REPLICA SETS
   DOMAIN SYSTEM VOLUME (SYSVOL SHARE) in state JRNL_WRAP_ERROR

DELETED REPLICA SETS
0
 
snusgubbenCommented:
That's why Conntat.txt is empty. This DC is in Journal Wrap.

http://adfordummiez.com/?p=61

Are both your DCs Win2003?

Journal Wrap are easy to fix. You have to set the Burflags to "D2" on the DC that is in JW, but you need to restart FRS... That was a problem if i recall?
0
 
wtcsAuthor Commented:
i cannot start the service with elevated rights, i get a system error5 has occurred. access is denied.
0
 
snusgubbenCommented:
And you don't see "File Replication Service" in services.msc? According to the "ntfrs_reg.txt" it looks like the service is registered correctly.
0
 
wtcsAuthor Commented:
0
 
snusgubbenCommented:
Do you see the service on the 2003 DC? (services.msc)
0
 
wtcsAuthor Commented:
did not
0
 
snusgubbenCommented:
Have you started a FRS to DFSR migration?
0
 
wtcsAuthor Commented:
i have not, this server is the first of two "main" servers that have AD on both of them. 2 weeks ago i had to demote the other server and then promote. i have run replmon and monitored the servers and see that it is replicating. however in the event view i have several errors under file replication service. I also have a ton of error say is saying my group policies are not working right.
0
 
wtcsAuthor Commented:

Log Name:      File Replication Service
Source:        NtFrs
Date:          3/3/2011 9:57:29 PM
Event ID:      13568
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      RLISD-DC2.rlisd.local
Description:
The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR.
 
 Replica set name is    : "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
 Replica root path is   : "c:\windows\sysvol\domain"
 Replica root volume is : "\\.\C:"
 A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found.  This can occur because of one of the following reasons.
 
 [1] Volume "\\.\C:" has been formatted.
 [2] The NTFS USN journal on volume "\\.\C:" has been deleted.
 [3] The NTFS USN journal on volume "\\.\C:" has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.
 [4] File Replication Service was not running on this computer for a long time.
 [5] File Replication Service could not keep up with the rate of Disk IO activity on "\\.\C:".
 Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.
 [1] At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run "net stop ntfrs" followed by "net start ntfrs" to restart the File Replication Service.
 [2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.
 
WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.
 
To change this registry parameter, run regedit.
 
Click on Start, Run and type regedit.
 
Expand HKEY_LOCAL_MACHINE.
Click down the key path:
   "System\CurrentControlSet\Services\NtFrs\Parameters"
Double click on the value name
   "Enable Journal Wrap Automatic Restore"
and update the value.
 
If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="NtFrs" />
    <EventID Qualifiers="49152">13568</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-03-04T03:57:29.000Z" />
    <EventRecordID>90</EventRecordID>
    <Channel>File Replication Service</Channel>
    <Computer>RLISD-DC2.rlisd.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>DOMAIN SYSTEM VOLUME (SYSVOL SHARE)</Data>
    <Data>c:\windows\sysvol\domain</Data>
    <Data>\\.\C:</Data>
    <Data>5</Data>
  </EventData>
</Event>
0
 
snusgubbenCommented:
You should not follow the way the Event message say to recover from Journal Wrap.

You could try setting the Burflags to D2, and restart the DC that is in JW.

http:#35176561
0
 
wtcsAuthor Commented:
so the server that i ran frsdiag.exe on will be the one with the journal wrap?
0
 
snusgubbenCommented:
Yes (the DC logging event id 13568)
0
 
wtcsAuthor Commented:
i will try it and let you know. thanks
0
 
wtcsAuthor Commented:
changing the burr flags did not work, i had to change roles to other server, demote, run metadata cleanup,then promote.  
0
 
QlemoC++ DeveloperCommented:
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 17
  • 11
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now