I have a sbs2008 server that keeps giving event ID 13568 every time I reboot. I tried to push a group policy recently, but was unsuccessful, it was a software installer. I looked up several articles regarding this and I am getting conflicting messages. One is telling me to do this:
Click down the key path:
Double click on the value name
“Enable Journal Wrap Automatic Restore”
and update the value. - See more at: http://blog.ronnypot.nl/?p=738#sthash.GJpYe9rU.dpuf
But then I read an article where that will cause issues with not being able to login because the sysvol disappears,
then I read an article that suggested I do a non-authoritive restore (D2) which would be the correct method...
But that confuses me as well. How can you do a non authoritative restore with no other DC on the network??
1. Click Start, and then click Run.
2. In the Open box, type cmd and then press ENTER.
3. In the Command box, type net stop ntfrs.
(make a backup copy of the contents of the Pre-existing folder if it exists, then copy those to the parent folder)
4. Click Start, and then click Run.
5. In the Open box, type regedit and then press ENTER.
6. Locate the following subkey in the registry:
rocess at Startup
7. In the right pane, double-click BurFlags.
8. In the Edit DWORD Value dialog box, type D2 and then click OK.
9. Quit Registry Editor, and then switch to the Command box.
10. In the Command box, type net start ntfrs.
11. Quit the Command box.
Within a minute or two, you should see event ID 13516 post in the event viewer:
see the link below...
Another post says to do a D4