Event ID 13568 - JRNL_WRAP_ERROR - Only 1 Domain Controller

ITNC used Ask the Experts™
The error below is recorded in the FRS Event Log.  If I only have one domain controller in this environment will the steps below be safe to perform?  Should I create a copy of the SYSVOL, etc before I do this?  Again, there is ONLY ONE domain controller in this environment and I've typically seen these problems be fixed when there is a "working replica" domain controller to replicate from.

The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR.
 Replica set name is    : "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
 Replica root path is   : "c:\windows\sysvol\domain"
 Replica root volume is : "\\.\C:"
 A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found.  This can occur because of one of the following reasons.
 [1] Volume "\\.\C:" has been formatted.
 [2] The NTFS USN journal on volume "\\.\C:" has been deleted.
 [3] The NTFS USN journal on volume "\\.\C:" has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.
 [4] File Replication Service was not running on this computer for a long time.
 [5] File Replication Service could not keep up with the rate of Disk IO activity on "\\.\C:".
 Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.
 [1] At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run "net stop ntfrs" followed by "net start ntfrs" to restart the File Replication Service.
 [2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.
WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.
To change this registry parameter, run regedit.
Click on Start, Run and type regedit.
Click down the key path:
Double click on the value name
   "Enable Journal Wrap Automatic Restore"
and update the value.
If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above.
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Top Expert 2013

In that case with one DC you can do a D4 authoritative restore   http://adfordummiez.com/?p=61   nothing to pull from for a D2




I was afraid of that... I am going to start the process and I'll post my results afterwards.

Top Expert 2013

By the way is this production with real users or a test lab?  Reason I ask is if it is production the next project is to get a second DC up when you can.


Exploring SQL Server 2016: Fundamentals

Learn the fundamentals of Microsoft SQL Server, a relational database management system that stores and retrieves data when requested by other software applications.


it's production.  (I actually have another DC that I recently promoted, it replicates fine in sites & services) but the sysvol wasn't showing up...that's what prompted me to start researching then i discovered the JRNL_WRAP_ERROR on the existing DC.. I'm hoping fixing the JRNL_WRAP error will also fix the SYSVOL not replicating to the newly promoted DC.

it's production.  (I actually have another DC that I recently promoted, it replicates fine in sites & services) but the sysvol wasn't showing up.

Event id 13568 indicates that the DC's replica set is in journal wrap state.

So now you have 2 DCs (existing and new one) and to resolve this issue, you need perform the D2 & D4, also known as non-authorative & authorative restore.

D2 and D4; What is it for ?

1. First perform D4 on JRNL_WRP problem DC then go for D2 on new DC. This process will share the SYSVOL and NETLOGON on new DC.

Follow this KB article- Using the BurFlags registry key to reinitialize File Replication Service replica sets: http://support.microsoft.com/kb/290762

If still issue reoccurs, follow how to rebuild the SYSVOL tree and its content in a domain.

NOTE: Prior to perform any step please make sure that sysvol is backed up(copy & paste) on each DC.
Technical Lead
Top Expert 2011
Your first step should be finding why JRNL_WRAP_ERROR error has occurred. Normally, JRNL_WRAP_ERROR occurs due to drive/partition being corrupted, antivirus locking and corrupting the file during sysvol scan, heavy size of the files inside sysvol and netlogon shares.

The solution is listed in your event log.

Click down the key path: "System\CurrentControlSet\Services\NtFrs\Parameters"
Double click on the value name  "Enable Journal Wrap Automatic Restore" and update the value.
If the key is not present yoe need to create the same and set the value to 1.

Once Automatic recovery is completed you need to set Enable Journal Wrap Automatic Restore value to 0

If the JRNL_WRAP_ERROR occurs frequently, you need to exclude sysvol/netlogon from antvirus scan, check the drive for corruption or bad sector and also restore a sysvol using burflag key.


Alternately you can perform authorative(D4) restore to fix the Journal Wrap issue as you have single DC in the environment.

If you have multiple DC then in that case you need to perform D4 on healthy DC and D2 on the other DC.
Reference link:http://support.microsoft.com/kb/290762

Note:Take the backup of policies and script folder from sysvol before you proceed.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial