Fix FRS event 13568 JRNL_WRAP_ERROR on Server 2008

kliler
kliler used Ask the Experts™
on
We have one SBS 2008 PDC and one Server 2012 R2 DC. Attempting to decommission the 2008 DC and found that event 13568 in FRS has been coming up every boot for the last few years but the SYSVOL and NETLOGON shares on the 2008 DC were still showing up despite event 13516 never being logged. The 2012 R2 DC apparently never shared the SYSVOL and NETLOGON shares when we promoted it.

Backed up the contents of the SYSVOL and NETLOGON folders.

Followed the steps in the 13568 log to perform the following:
---
 Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.
 [1] At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run "net stop ntfrs" followed by "net start ntfrs" to restart the File Replication Service.
 [2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.
 
WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.
 
To change this registry parameter, run regedit.
 
Click on Start, Run and type regedit.
 
Expand HKEY_LOCAL_MACHINE.
Click down the key path:
   "System\CurrentControlSet\Services\NtFrs\Parameters"
Double click on the value name
   "Enable Journal Wrap Automatic Restore"
and update the value.
---

After that the sysvol/netlogon shares on the 2008 DC never came back.
Set the registry key back to 0.
We also have reports of workstations not able to locate the domain.
Opening AD Users and Computers on either server results in "Naming information cannot be located because the
specified domain does not exist or could not be contacted"

The FRS log on the 2008 DC shows events 13566, 13562 and 13508.

Upon restarting the 2008 DC was able to briefly access AD Users and Computers but overnight that went away.

Any help is appreciated. Thanks!
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Distinguished Expert 2017
Commented:
After making he registry settings change, did you restart the service?
Look at D2/D4 burflags (use D4 authoritative, primary) while the 2012 Dc has the ntfrs services/key stopped.)


make sure %windir%\system32\sysvol\sysvol has the structure check the stracture on the 2012 .....

Author

Commented:
Performing the D4 on the primary and D2 on the new DC worked! We were able to complete retiring the SBS server without any further issues.

Followed the steps outlined here: https://blogs.msmvps.com/acefekay/2013/08/28/how-to-recover-a-journal-wrap-error-jrnl_wrap_error-and-a-corrupted-sysvol-from-a-good-dc-what-option-do-i-use-d4-or-d2-whats-the-difference-between-d4-and-d2/

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial