Event ID: 13508 - The File Replication Service is having trouble enabling replicatiing

I am getting the following event warning on our Primary DC.

Computer: SERVER1
Monitor Title: "Event Log Errors" (Type=Event Log Monitor)
* Event Time: 2012/01/05 12:22:53 PM
* Source: NtFrs
* Type: Warning Event
* Event ID: 13508
* The File Replication Service is having trouble enabling replication from SERVER2 to SERVER1 for c:\windows\sysvol\domain using the DNS name Server2.domain.local. FRS will keep retrying.

 Following are some of the reasons you would see this warning.
 [1] FRS can not correctly resolve the DNS name Server2.domain.local from this computer.
 [2] FRS is not running on Server2.domain.local.
 [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers.
 This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.

Server1 - Windows 2008 STD (64Bit) - DC with all FSMO role running from here.
Server2 - Windows Server 2003 STD (32Bit) - DC - Exchange 2003

- I have checked and do not get any Event logs for EventID 13509 to say it has been resolved.
- FRS is running on both servers
- I can ping both servers from each other.
- ntfrsutl server2.domain.local runs successfully from Server1
- I have checked DNS and that seens to be running fine too.

Are there any other suggestions?
Barry KaySystems EngineerAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Can you please confirm:
Server1 is your PDC?
Server2 is your ADC?
DNS is AD integrated?

Also, can you post nslookup results of machine?

one of the problems causing this is time synchronization, let's try it first:
for this you need to run this command in every PC or server having this warning to make them synchronize with the DC :
net time \\(nom_contrôleur_domaine) /set /y

After, you need to restart replication service on every server having this warning and check if it's gone.

Let me know about it;
Thank you.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
AmitIT ArchitectCommented:
You don't need to take any action EventID 13509 indicates problem is resolved. Ignore it.
The Five Tenets of the Most Secure Backup

Data loss can hit a business in any number of ways. In reality, companies should expect to lose data at some point. The challenge is having a plan to recover from such an event.

Neil RussellTechnical Development LeadCommented:
Helllo?? "- I have checked and do not get any Event logs for EventID 13509 to say it has been resolved."
AmitIT ArchitectCommented:
Below are few troubleshooting Steps related to AD issues. This might help you.

Critical Errors

Event ID: -- 467 – Directory Service Event
Indication – AD Database table has been corrupt.
Resolution – Perform a offline defragmentation of AD Database or Remove the AD database from the server and reinstall AD.

Warning Errors

File Replication Events

Event ID: 13508 – Unable to create RPC connection to replication partner
A single FRS event ID 13508 does not mean anything is broken or not working, as long as it is followed by FRS event ID 13509, which indicates that the problem was resolved.
Check for Event ID 13509 after 13508 if not troubleshoot the event 13508
Resolution – Stop and start the File Replication service.
1. Run --> cmd --> net stop ntfrs (stopping the service)
2. Net start ntfrs (starting the service)
Note: Stopping and starting the service should be done strictly after business hours.

Event ID: 13568 – Indicates FRS is in Journal Wrap state
To perform a nonauthoritative restore, stop the FRS service, configure the BurFlags registry key, and then restart the FRS service. To do so:
1) Open Registy and locate:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup
2). Double-click BurFlags.
3). Type D2 and then click OK.
4). Close Regedit
5). Open cmd, type net start ntfrs.
11. Quit cmd
When the FRS service restarts, the following actions occur:
• BurFlags registry key returns to 0.
• Event 13565 is logged, which indicates that nonauthoritative restore is started.
• Finally an event 13516 is logged, indicating that FRS is operational.

Directory Service Events:
Event ID: 1925, 1311, 1865, and 1566 --- These Events indicate KCC (Knowledge Consistency Checker) Errors
1) Check there is no network issues in the site.
2) Check the DC by running a Basic DNS test. (Run --> cmd --> dcdiag /test:dns /s:sourcedomaincontrollername /Dnsbasic).
For EX:- dcdiag /test:dns /s:prdssdc003 /Dnsbasic
3) Check DNS Registration by running the following command.
Dcdiag /test:dns /DnsRecordRegistration.
Event ID: 1079, 1169 --- This Event is trigerred if Active Directory is unable to perform replication if there is a low memory to perform the operation.
AmitIT ArchitectCommented:
@Neilsr Thanks for pointing. I missed that :)
Barry KaySystems EngineerAuthor Commented:
Thaks for the commenst so far...
 @Neilsr: I mean here is that there are no EventID 13509 in the logs, so I know the issue is not correcting itself.

@AhmedHERMI:  I did this and restarted the Replication service.
Then I the saw a another Error on Server2 -  EventID 13561:
The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR.
 Replica set name is    : "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
 Replica root path is   : "c:\windows\sysvol\domain"
 Replica root volume is : "\\.\C:"
 A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found.  This can occur because of one of the following reasons.
 [1] Volume "\\.\C:" has been formatted.
 [2] The NTFS USN journal on volume "\\.\C:" has been deleted.
 [3] The NTFS USN journal on volume "\\.\C:" has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.
 [4] File Replication Service was not running on this computer for a long time.
 [5] File Replication Service could not keep up with the rate of Disk IO activity on "\\.\C:".
 Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.
 [1] At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run "net stop ntfrs" followed by "net start ntfrs" to restart the File Replication Service.
 [2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.
WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.
To change this registry parameter, run regedit.
Click on Start, Run and type regedit.
Click down the key path:
Double click on the value name
   "Enable Journal Wrap Automatic Restore"
and update the value.
If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above.

I have followed these steps and so far so good.
I will monitor and post what the outcome was when I have more info...

Hi Box,

@Neilsr kindly read the following :-

By doing D2 you will do non-authoratative restore
.Kindly go through the following article -- http://support.microsoft.com/kb/315457

When,you are modifying the following key :-

"HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup" its going to do a non-authoritative restore every time FRS service is started,which world delete the Policies and Scripts from SYSVOL.

Insted make changes to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Cumilatative Replica set\BURFLAG

D4 on FSMO role holder and D2 on the ADC.As Microsoft says that FSMO role holder specially the one which has PDC role is the GOOD DC...!!

Note:--Take a back up of SYSVOL

Hopw this helps !!!

You should get the DC logging the 13568 event out of the Journal Wrap state by setting the Burflags regisry key to "d2" (hex) and restart the ntfrs service.

Setting the Burflags to "d4" is not necessary and should only be set when you'll have to rebuild the replica set. You don't want that.

Barry KaySystems EngineerAuthor Commented:
All help appreciated.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.