File Replication Service - Ntfrs error 13568

[scjlin]

One of my domain controller is experiencing Ntfrs error.

Ntfrs event id: 13568
The File Replication Service has detected that the
replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in
JRNL_WRAP_ERROR.

I ran the chkdsk, chkdsk /f, and add "Ntfs Journal size
in MB" in the registry. However the server still showing
errors.

DC - Windows 2000 with SP4 holds all operation master
roles.

These are the KB that I used, but still not work:
"Active Directory Operations Overview, Troubleshooting
File Replication Service".
KB292438
KB221111


Run netdiag with all test passed.
Run dcdiag got following error:
Starting test: frssysvol
Error: No record of File Replication System, SYSVOL started. The Active Directory may be prevented from starting. (Check with KB30583 already)



Thanks


SL

 

[mlichstein]

Couple of questions:

Do you have other DCs? If so, are they journal wrapped?

How much free space do you have on this servers c: drive?

 

[scjlin]

Thanks for reply

Yes, I have 2 more DCs at HQ experiencing the warning messages when main DC shows ntfrs errors.

Ntfrs warning: 13508
The File Replication Service is having trouble enabling replication from dc1 to dc2 for c:\winnt\sysvol\domain using the DNS name dc1.abc.com FRS will keep retrying.
Following are some of the reasons you would see this warning.

C drive on server has C: 800MB space total of 4Gig. Also I added Ntfs Journal size in MB for 128 but still seem not fixing the problem.

 

[mlichstein]

Ok good you have other working DCs. First take out the NTFS journal size registry entry you added, since you don't need it.

Then stop the file replication service. Then open regedit and go to HKLM\System\CurrentControlSet\Services\Ntfrs\Parameters\Backup/Restore\Process at Startup.

There you will find a value called Burflags. Change this to 'D2' (hexidecimal) then start the file replication service.

 

[scjlin]

Thanks for information.

I just made the changes to my dc1, and now errors are gone. However these events happen after I restart the service.

3:05:49pm
Ntfrs Warning: 13565
File Replication Service is initializing the system volume with data from another domain controller. Computer DC1 cannot become a domain controller until this process is complete. The system volume will then be shared as SYSVOL.

3:05:50pm
Ntfrs Warning: 13520
The File Replication Service moved the preexisting files in c:\winnt\sysvol\domain to c:\winnt\sysvol\domain\NtFrs_PreExisting___See_EventLog.

Check shared folder a folder called “NtFrs_PreExisting___See_EventLog” created in \\dc1\sysvol\abc.com and it contains policies, and scripts.

Check with other DCs. One of dc (dc3) shows following warning:
DC3
3:10:53pm
Ntfrs warning: 13509
The File Replication Service has enabled replication from dc1 to dc3 for c:\winnt\sysvol\domain after repeated retries.


Thanks for help~~


SL

 

[mlichstein]

Yep, those are normal warnings. You should be good to go.

 

[scjlin]

After another reboot on DC1 the warring message not long shows up. However, some of my GP are not able to apply to OU. It seems like some of policies went to NtFrs_PreExisting___See_EventLog folder. And leave only folder name in abc.com\policies folder. My question is can I copy the content of the policy from NtFrs_PreExisting to abc.com\policies folder if the folder names are same? Will AD able to pickup the file configuration and apply to OU?

Thanks,


SL

 

[mlichstein]

Those policies should have come from one of your other DCs. Check the policies folder on the other servers and see if there is anything there.

 

[scjlin]

Again, thanks for your help mlichstein.
I briefly check policies folders in all three DCs. It seems like policies are the same. I think the NtFrs_PreExisting___See_EventLog policies come from dc1. I guess I will just recreate these GPs in AD and see what happen.

Thanks again,


SL