Event ID 13568 - JRNL_WRAP_ERROR - Only 1 Domain Controller

The error below is recorded in the FRS Event Log.  If I only have one domain controller in this environment will the steps below be safe to perform?  Should I create a copy of the SYSVOL, etc before I do this?  Again, there is ONLY ONE domain controller in this environment and I've typically seen these problems be fixed when there is a "working replica" domain controller to replicate from.



The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR.
 
 Replica set name is    : "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
 Replica root path is   : "c:\windows\sysvol\domain"
 Replica root volume is : "\\.\C:"
 A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found.  This can occur because of one of the following reasons.
 
 [1] Volume "\\.\C:" has been formatted.
 [2] The NTFS USN journal on volume "\\.\C:" has been deleted.
 [3] The NTFS USN journal on volume "\\.\C:" has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.
 [4] File Replication Service was not running on this computer for a long time.
 [5] File Replication Service could not keep up with the rate of Disk IO activity on "\\.\C:".
 Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.
 [1] At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run "net stop ntfrs" followed by "net start ntfrs" to restart the File Replication Service.
 [2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.
 
WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.
 
To change this registry parameter, run regedit.
 
Click on Start, Run and type regedit.
 
Expand HKEY_LOCAL_MACHINE.
Click down the key path:
   "System\CurrentControlSet\Services\NtFrs\Parameters"
Double click on the value name
   "Enable Journal Wrap Automatic Restore"
and update the value.
 
If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above.
ITNCAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Mike KlineCommented:
In that case with one DC you can do a D4 authoritative restore   http://adfordummiez.com/?p=61   nothing to pull from for a D2

Thanks

Mike
0
ITNCAuthor Commented:
I was afraid of that... I am going to start the process and I'll post my results afterwards.

0
Mike KlineCommented:
By the way is this production with real users or a test lab?  Reason I ask is if it is production the next project is to get a second DC up when you can.

Thanks

Mike
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

ITNCAuthor Commented:
it's production.  (I actually have another DC that I recently promoted, it replicates fine in sites & services) but the sysvol wasn't showing up...that's what prompted me to start researching then i discovered the JRNL_WRAP_ERROR on the existing DC.. I'm hoping fixing the JRNL_WRAP error will also fix the SYSVOL not replicating to the newly promoted DC.

0
abhijitwaikarCommented:
it's production.  (I actually have another DC that I recently promoted, it replicates fine in sites & services) but the sysvol wasn't showing up.

Event id 13568 indicates that the DC's replica set is in journal wrap state.

So now you have 2 DCs (existing and new one) and to resolve this issue, you need perform the D2 & D4, also known as non-authorative & authorative restore.

D2 and D4; What is it for ?
http://blogs.technet.com/b/janelewis/archive/2006/09/18/457100.aspx

Steps:
1. First perform D4 on JRNL_WRP problem DC then go for D2 on new DC. This process will share the SYSVOL and NETLOGON on new DC.

Follow this KB article- Using the BurFlags registry key to reinitialize File Replication Service replica sets: http://support.microsoft.com/kb/290762

If still issue reoccurs, follow how to rebuild the SYSVOL tree and its content in a domain.
http://support.microsoft.com/kb/315457/

NOTE: Prior to perform any step please make sure that sysvol is backed up(copy & paste) on each DC.
0
SandeshdubeySenior Server EngineerCommented:
Your first step should be finding why JRNL_WRAP_ERROR error has occurred. Normally, JRNL_WRAP_ERROR occurs due to drive/partition being corrupted, antivirus locking and corrupting the file during sysvol scan, heavy size of the files inside sysvol and netlogon shares.

The solution is listed in your event log.

Expand HKEY_LOCAL_MACHINE.
Click down the key path: "System\CurrentControlSet\Services\NtFrs\Parameters"
Double click on the value name  "Enable Journal Wrap Automatic Restore" and update the value.
If the key is not present yoe need to create the same and set the value to 1.

Once Automatic recovery is completed you need to set Enable Journal Wrap Automatic Restore value to 0

If the JRNL_WRAP_ERROR occurs frequently, you need to exclude sysvol/netlogon from antvirus scan, check the drive for corruption or bad sector and also restore a sysvol using burflag key.

http://msdn.microsoft.com/en-us/library/windows/desktop/cc507518%28v=vs.85%29.aspx

Alternately you can perform authorative(D4) restore to fix the Journal Wrap issue as you have single DC in the environment.

If you have multiple DC then in that case you need to perform D4 on healthy DC and D2 on the other DC.
Reference link:http://support.microsoft.com/kb/290762

Note:Take the backup of policies and script folder from sysvol before you proceed.


1

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.