troubleshooting Question

Fix FRS event 13568 JRNL_WRAP_ERROR on Server 2008

Avatar of kliler
kliler asked on
SBSWindows Server 2012Windows Server 2008Active Directory
2 Comments1 Solution232 ViewsLast Modified:
We have one SBS 2008 PDC and one Server 2012 R2 DC. Attempting to decommission the 2008 DC and found that event 13568 in FRS has been coming up every boot for the last few years but the SYSVOL and NETLOGON shares on the 2008 DC were still showing up despite event 13516 never being logged. The 2012 R2 DC apparently never shared the SYSVOL and NETLOGON shares when we promoted it.

Backed up the contents of the SYSVOL and NETLOGON folders.

Followed the steps in the 13568 log to perform the following:
---
 Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.
 [1] At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run "net stop ntfrs" followed by "net start ntfrs" to restart the File Replication Service.
 [2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.
 
WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.
 
To change this registry parameter, run regedit.
 
Click on Start, Run and type regedit.
 
Expand HKEY_LOCAL_MACHINE.
Click down the key path:
   "System\CurrentControlSet\Services\NtFrs\Parameters"
Double click on the value name
   "Enable Journal Wrap Automatic Restore"
and update the value.
---

After that the sysvol/netlogon shares on the 2008 DC never came back.
Set the registry key back to 0.
We also have reports of workstations not able to locate the domain.
Opening AD Users and Computers on either server results in "Naming information cannot be located because the
specified domain does not exist or could not be contacted"

The FRS log on the 2008 DC shows events 13566, 13562 and 13508.

Upon restarting the 2008 DC was able to briefly access AD Users and Computers but overnight that went away.

Any help is appreciated. Thanks!
ASKER CERTIFIED SOLUTION
Join our community to see this answer!
Unlock 1 Answer and 2 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 2 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros