Event ID: 13508 - The File Replication Service is having trouble enabling replicatiing

I am getting the following event warning on our Primary DC.

Computer: SERVER1
Monitor Title: "Event Log Errors" (Type=Event Log Monitor)
* Event Time: 2012/01/05 12:22:53 PM
* Source: NtFrs
* Type: Warning Event
* Event ID: 13508
* The File Replication Service is having trouble enabling replication from SERVER2 to SERVER1 for c:\windows\sysvol\domain using the DNS name Server2.domain.local. FRS will keep retrying.

 Following are some of the reasons you would see this warning.
 [1] FRS can not correctly resolve the DNS name Server2.domain.local from this computer.
 [2] FRS is not running on Server2.domain.local.
 [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers.
 This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.

Server1 - Windows 2008 STD (64Bit) - DC with all FSMO role running from here.
Server2 - Windows Server 2003 STD (32Bit) - DC - Exchange 2003

- I have checked and do not get any Event logs for EventID 13509 to say it has been resolved.
- FRS is running on both servers
- I can ping both servers from each other.
- ntfrsutl server2.domain.local runs successfully from Server1
- I have checked DNS and that seens to be running fine too.

Are there any other suggestions?
Barry KaySystems EngineerAsked:
Who is Participating?
AhmedHERMIConnect With a Mentor Commented:

one of the problems causing this is time synchronization, let's try it first:
for this you need to run this command in every PC or server having this warning to make them synchronize with the DC :
net time \\(nom_contrôleur_domaine) /set /y

After, you need to restart replication service on every server having this warning and check if it's gone.

Let me know about it;
Thank you.
Can you please confirm:
Server1 is your PDC?
Server2 is your ADC?
DNS is AD integrated?

Also, can you post nslookup results of machine?
AmitIT ArchitectCommented:
You don't need to take any action EventID 13509 indicates problem is resolved. Ignore it.
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

Neil RussellTechnical Development LeadCommented:
Helllo?? "- I have checked and do not get any Event logs for EventID 13509 to say it has been resolved."
AmitConnect With a Mentor IT ArchitectCommented:
Below are few troubleshooting Steps related to AD issues. This might help you.

Critical Errors

Event ID: -- 467 – Directory Service Event
Indication – AD Database table has been corrupt.
Resolution – Perform a offline defragmentation of AD Database or Remove the AD database from the server and reinstall AD.

Warning Errors

File Replication Events

Event ID: 13508 – Unable to create RPC connection to replication partner
A single FRS event ID 13508 does not mean anything is broken or not working, as long as it is followed by FRS event ID 13509, which indicates that the problem was resolved.
Check for Event ID 13509 after 13508 if not troubleshoot the event 13508
Resolution – Stop and start the File Replication service.
1. Run --> cmd --> net stop ntfrs (stopping the service)
2. Net start ntfrs (starting the service)
Note: Stopping and starting the service should be done strictly after business hours.

Event ID: 13568 – Indicates FRS is in Journal Wrap state
To perform a nonauthoritative restore, stop the FRS service, configure the BurFlags registry key, and then restart the FRS service. To do so:
1) Open Registy and locate:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup
2). Double-click BurFlags.
3). Type D2 and then click OK.
4). Close Regedit
5). Open cmd, type net start ntfrs.
11. Quit cmd
When the FRS service restarts, the following actions occur:
• BurFlags registry key returns to 0.
• Event 13565 is logged, which indicates that nonauthoritative restore is started.
• Finally an event 13516 is logged, indicating that FRS is operational.

Directory Service Events:
Event ID: 1925, 1311, 1865, and 1566 --- These Events indicate KCC (Knowledge Consistency Checker) Errors
1) Check there is no network issues in the site.
2) Check the DC by running a Basic DNS test. (Run --> cmd --> dcdiag /test:dns /s:sourcedomaincontrollername /Dnsbasic).
For EX:- dcdiag /test:dns /s:prdssdc003 /Dnsbasic
3) Check DNS Registration by running the following command.
Dcdiag /test:dns /DnsRecordRegistration.
Event ID: 1079, 1169 --- This Event is trigerred if Active Directory is unable to perform replication if there is a low memory to perform the operation.
AmitIT ArchitectCommented:
@Neilsr Thanks for pointing. I missed that :)
Barry KayConnect With a Mentor Systems EngineerAuthor Commented:
Thaks for the commenst so far...
 @Neilsr: I mean here is that there are no EventID 13509 in the logs, so I know the issue is not correcting itself.

@AhmedHERMI:  I did this and restarted the Replication service.
Then I the saw a another Error on Server2 -  EventID 13561:
The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR.
 Replica set name is    : "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
 Replica root path is   : "c:\windows\sysvol\domain"
 Replica root volume is : "\\.\C:"
 A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found.  This can occur because of one of the following reasons.
 [1] Volume "\\.\C:" has been formatted.
 [2] The NTFS USN journal on volume "\\.\C:" has been deleted.
 [3] The NTFS USN journal on volume "\\.\C:" has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.
 [4] File Replication Service was not running on this computer for a long time.
 [5] File Replication Service could not keep up with the rate of Disk IO activity on "\\.\C:".
 Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.
 [1] At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run "net stop ntfrs" followed by "net start ntfrs" to restart the File Replication Service.
 [2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.
WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.
To change this registry parameter, run regedit.
Click on Start, Run and type regedit.
Click down the key path:
Double click on the value name
   "Enable Journal Wrap Automatic Restore"
and update the value.
If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above.

I have followed these steps and so far so good.
I will monitor and post what the outcome was when I have more info...

Hi Box,

@Neilsr kindly read the following :-

By doing D2 you will do non-authoratative restore
.Kindly go through the following article -- http://support.microsoft.com/kb/315457

When,you are modifying the following key :-

"HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup" its going to do a non-authoritative restore every time FRS service is started,which world delete the Policies and Scripts from SYSVOL.

Insted make changes to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Cumilatative Replica set\BURFLAG

D4 on FSMO role holder and D2 on the ADC.As Microsoft says that FSMO role holder specially the one which has PDC role is the GOOD DC...!!

Note:--Take a back up of SYSVOL

Hopw this helps !!!

You should get the DC logging the 13568 event out of the Journal Wrap state by setting the Burflags regisry key to "d2" (hex) and restart the ntfrs service.

Setting the Burflags to "d4" is not necessary and should only be set when you'll have to rebuild the replica set. You don't want that.

Barry KaySystems EngineerAuthor Commented:
All help appreciated.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.