Avatar of James Smith
James SmithFlag for United States of America asked on

Active Directory Error 13568 - Replication Issue

Seems whenever I add a new Group Policy, the policy is added to Group policy manager and shows up on the sysvol on DC1 (DC1 is the schema master, 2003 server), but that is where is stops. All other DC's, which is a mixture of 2003 and 2008 are not getting any sysvol replication (FRS).  DC1 is also not replicating updates or changed policies to the other DC’s.  

Sites and services do replicate and shows no errors on dc1.  I only find the below error on on startup. (please see attached)
Error.txt
Windows Server 2003Active DirectoryWindows Server 2008

Avatar of undefined
Last Comment
James Smith

8/22/2022 - Mon
Mike Kline

The message tells you to set the "enable registry parameter" entry in the registry, that might not work and the DS team talked about it here

http://blogs.technet.com/b/askds/archive/2010/08/20/friday-mail-sack-scooter-edition.aspx#frsevent

You can also do a non-authoritative restore of sysvol  on the box having issues

http://support.microsoft.com/kb/290762/en-us

Thanks

Mike
ASKER
James Smith

Hi Mike,

I have used the " Enable Journal Wrap Automatic Restore registry parameter to 1", but i am concerned that this problem is located on the Schema master that houses the Group policy objects.   I guess i am just hesitant to do it on the main DC. Do you see any issues with it?
Mike Kline

The schema master doesn't have anything to do with group policy, you only need that FSMO role if you are making changes to the schema (rare)

Thanks

Mike
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
Sarang Tinguria

first check that you have proper Connection objects has been created in Sites and Services

Browse \\WorkingDC.domain.local copy sysvol & netlogon and keep backup on ProblemDC &  WorkingDC (If can not browse check network connectivity/Port and don't proceed further)

Go to ProblemDC  stop NTFRS service open regedit go to "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at <samp>Startup" change the burflag value to D2 -> Start NTFRS(File Replication service) service and wait for File Replication event ID 13516 now

Check Now your sysvol and netlogon shares are available

Above is called non-Authoritive Restore (D2)

Refer http://support.microsoft.com/kb/257338 for more info

What happens in a Journal Wrap?
http://blogs.technet.com/b/instan/archive/2009/07/14/what-happens-in-a-journal-wrap.aspx
ASKER
James Smith

Hi Mike,

One last question, if dc1 (schema master) is down or offline i am unable to pull up Group Policy Management. I am not sure why that is.

Error is when server is down..
The Specified domain controller could not be contacted. This affects the following domain in the console
The error was:
The specified domain does not exist or could not be contacted.
Sandesh Dubey

I will recommend to first verify the health of DCs by dcdiag /q and repadmin /replsum and post the log if error is reported.The error mesage you posted indicates that FRS is in Journal Wrap error state.Perfroming sysvol restore normaly fix the issue but if there is replication issue between DCs then this will not work.

I will proceed like this check the health of DC first if no error reported then fix the journal wrap error as below.

Your first step should be finding why JRNL_WRAP_ERROR error has occurred. Normally, JRNL_WRAP_ERROR occurs due to drive/partition being corrupted, antivirus locking and corrupting the file during sysvol scan, heavy size of the files inside sysvol and netlogon shares.

The solution is listed in your event log.

Expand HKEY_LOCAL_MACHINE.
Click down the key path: "System\CurrentControlSet\Services\NtFrs\Parameters"
Double click on the value name  "Enable Journal Wrap Automatic Restore" and update the value to 1.

If the JRNL_WRAP_ERROR occurs frequently, you need to exclude sysvol/netlogon from antvirus scan, check the drive for corruption or bad sector and also restore a sysvol using burflag key.http://msdn.microsoft.com/en-us/library/windows/desktop/cc507518%28v=vs.85%29.aspx

Kindly take the backup of the sysvol folder of windows 2008/2003 DC that is copy paste the content of the sysvol to temp location and perform the authorative and non authorative restore of sysvol as mentioned above.

Also ensure correct dns setting as this:http://abhijitw.wordpress.com/2012/03/03/best-practices-for-dns-client-settings-on-domain-controller/
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
Pramod Ubhe

ASKER
James Smith

Hello Sandeshdubey,

I have run both dcdiag (please see attached errors) and repadmin (no errors).

Should i contunue with the Journal Wrap Fix on this main DC?
DC1-2003-Main-DC.txt
Mdc3-2008-error.txt
Sandesh Dubey

You can proceed with fixing the Journal wrap error on DC as no error reported in replication.Enable Journal Wrap Automatic Restore or perform authorative and non authorative restore of sysvol.Essentially the "http://support.microsoft.com/kb/290762/" article.
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy
ASKER
James Smith

Perfect, going to do on Sept 23rd - will keep ticket open and follow up then.. Thank you
ASKER
James Smith

Hi I wanted to verify that i can move all the FSMO roles to one of our 2008 servers and demote this server.  Please see the attached it is our current FSMO server that we are having issues with.

This server has been a dc for a couple years.
DC1-Pic1.jpg
DC1-Pic2.jpg
Sandesh Dubey

Why do you want to demote the dc are the mentioned steps not working?

You can demote the dc normally if normal demotion is not possible then you need to forcefully demote dc followed by metadata cleanup.
http://msmvps.com/blogs/acefekay/archive/2010/10/05/complete-step-by-step-to-remove-an-orphaned-domain-controller.aspx

I will not recommend to demote dc this should be last point of restore.
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
ASKER
James Smith

Correct-  none of the above steps work.
The problem server (2003 server) contains all the FMSO roles for our domain.

 Figure next step would be to move the roles to a new server?
Sandesh Dubey

Before you proceed with demotion can you only post the dcdiag /q and repadmin /replsum output from all DCs.
ASKER
James Smith

This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23
ASKER CERTIFIED SOLUTION
Sandesh Dubey

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
ASKER
James Smith

d2 (non authorative) restore of sysvol worked  - also had a failing Hard Drive.

Thank you