We help IT Professionals succeed at work.

Demote a DC where NTFrs is not working

Can I demote a DC even though it is not doing NTFrs replication? NTDS replication is working fine. It is giving Jrnl Wrap errors in the NTFrs event log.

Here is the situation. Our customer has 3 servers (A, B, and C) in one domain that are all Domain Controllers. They are all running Server 2003 R2 Standard. Server A is also running Exchange 2003 SP2. We installed 2 new Servers (D and E) that are also DCs and are running Server 2008 R2. We did that Schema update to 2008 Schema on Server A and it replicated successfully. We moved the FSMO roles to Server D.

This is when we noticed that Server A was not doing NTFrs replication and had been in Jrnl Wrap error for a couple of months. I know we should have fixed this before installing the new DCs. NTFrs is working fine between the other 4 servers.

The plan is to demote the 3 old servers and shut them down. On server A we plan to uninstall Exchange before demoting it.

I want to make sure that there isn't something about the NTFrs not working on Server A that is going to make a mess out of this process.

Watch Question

Lee W, MVPTechnology and Business Process Advisor
Most Valuable Expert 2013

If you're going to get rid of it, I'd probably just treat it as a failed DC.  Get all other services off it, then pull it off the network and get rid of it, performing a metadata cleanup in AD afterwards.
Neil RussellTechnical Development Lead

Well first off what steps have you taken to cure the jrnl wrap so far?
Lee W, MVPTechnology and Business Process Advisor
Most Valuable Expert 2013
BTW, as a standard procedure BEFORE adding a DC to ANY environment, I make it a practice to review all event logs and run DCDIAG and NETDIAG to make sure everything is healthy before hand and avoid trouble.  I strongly recommend you consider that for your next upgrade.
Network Administrator, Network Consultant
Top Expert 2011
s windows 2003 DC is also a Exchange server, if yes you need to move Exchange to another box, uninstall Exchange first and then demote DC. There is Ntfrs error where windows 2003 DC can't replicate sysvol to windows 2008 and there is journal wrap error too.


Jorunal wrap error can be due to sysvol corruption, issues with the physical drive due to corruption/bad sector, antivirus scanning sysvol or network issues during sysvol replications. You can create the registry "Enable Journal Wrap Automatic Restore" on the DC with jrnl_wrap error and if you see frequently, reset the burflag then re-initializes the replication.

Below article is applicable for windows 2008 R2.



You can also use system state backup to restore sysvol/netlogon, if all the DC's report this error or you can follow below article.


Point Exchange server to new windows 2008 DC(make windows 2008 DC as DNS and GC too) for DNS in its NIC as preferred DNS server.

Regarding demotion of dc, it can be demote gracefully or forcefully whereas force removal requires metadata cleanup.




Thanks for the comments.

There will not be an Exchange server when we are done. The customer is up and running on an on-line Exchange Hosting Service.

The jrnl warp error is only occuring on Server A. The Servers that are supposed to replicate with Server A are giving warning Event ID 13508 that they are not replicating with Server A about once a day.

The other 4 servers are doing NTFrs replication OK. I created small text files at each DC in the Scripts folder under the SysVol share and they all appeared at each server except Server A.

Yes, we will be more careful next time.

1. Should I do the gracefull demotion after uninstalling Exchange?
2. Uninstall Exchange then shutdown and metadata cleanup?
3. Just shutdown and metadata cleanup.

Will the metadata cleanup remove the Exchange stuff from AD?
Metadata will not clean exchange references, so uninstall exchange gracefully.
demote the server as a DC gracefully if no then forcefully.
Clean up with metadata.

Force removal http://support.microsoft.com/kb/332199
Maen Abu-TabanjehNetwork Administrator, Network Consultant
Top Expert 2011

here is the article to cleanup metadata
You still have to fix FRS. Within a journal wrap situation, replication seizes between domain controllers. This is typically caused by DNS related issues, meaning the servers can't find each other, so they stop replicating.

On the DCs that you deem "Healthy", go to the command prompt and type DCdiag /test:DNS.. I'll bet you see DNS related errors there...

Once DNS is fixed (THE ROOT CAUSE), then you can restart FRS. Typically, this doesn't require setting the burflags to rebuild the sysvol and Netlogon shares. Instead, stopping FRS on all, then starting FRS on the FSMO role holder first, then others afterwards will restart replications...

If this has been pas the tombstoned era, you have to remove metadata. Remember that you will have AD, DNS and FRS metadata that you have to delete. This is why I like this article better than microsoft's metadata cleanup article....


Remember, you HAVE to fixe the root cause FIRST. This is typically DNS. Otherwise any efforts will be fruitless.

Locates Tombstoned servers:
Locates DNS issues:
DCdiag /test:DNS

NOTE: Any errors within the SYSTEM event logs will show up within a DCdiag test as a useless blurb. Since will be digging into the root problems, these event log errors will be redundant information and create a LONG dcdiag report. So, you may as well save and then wipe your event logs before running DCdiag. This will help you decipher between stale and real-time errors.


Thanks for all the help. The DNS tested fine. It looks like Server A was in Jrnl-Wrap because the NTFrs service had stopped for awhile. I did the registry change to D2 to force a non-authoritative restore. Replication then was working fine. Uninstalled Exchange. Demoted the 3 older servers and shut them down without too much trouble. DCDiag /v is good.

Thanks again.