Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 13514 Source: NtFrs

Source
Level
Description
The File Replication Service may be preventing the computer DESCARTES from becoming a domain controller while the system volume is being initialized with data from another domain controller and then shared as SYSVOL.

Type <strong>net share</strong> to check for the SYSVOL share.

The File Replication Service has stopped preventing the computer from becoming a domain controller once the SYSVOL share appears. The initialization of the system volume can take some time. The time is dependent on the amount of data in the system volume, the availability of other domain controllers, and the replication interval between domain controllers. The initialization of the system volume can be bypassed by first typing regedt32 and setting the value of SysvolReady to 1 and then restarting the Netlogon service. WARNING - BYPASSING THE SYSTEM VOLUME INITIALIZATION IS NOT RECOMMENDED. Applications may fail in unexpected ways.
Comments
 
See ME266657 to resolve this problem.
I found this issue after the installation of an additional domain controller in my Windows 2000 Active Directory network. Initially, I was under the impression that it was caused by the time synchronization in the timeserver. I used the command net time \\DC <file://\\DC> /SET.  However, it was not useful and did not solve my problem. I manually replicated information through Active Directory Sites and Services. This did not work either. I used the Windows 2000 Resource kit utility (REPLMON) to monitor the replication. Although replication was successful, and there were no errors, I was continuously getting error messages in my File Replication Service log file. After numerous attempts, I ran a command called dcdiag > dc.txt and netdiag /v > netdiag.txt. I read the result of both files and found the following error in dc.txt file:
”Starting test: Advertising
Warning: DsGetDcName returned information for \\dc1.domain.org <file://\\dc1.domain.org>, when we were trying to reach DC2.
Server is not responding or is not considered suitable.
......................... DC2 failed test Advertising”

I found the following error in the netdiag.txt:
”Domain membership test . . . . . . : Failed
WARNING] The system volume has not been completely replicated to the local machine. This machine is not working properly as a DC.
Machine is a . . . . . . . . . : Domain Controller
Netbios Domain name. . . . . . : DOMAIN
Dns domain name. . . . . . . . : domain.org
Dns forest name. . . . . . . . : domain.org
Domain Guid. . . . . . . . . . : {GUID of domain}
Domain Sid . . . . . . . . . . : S-1-.... Number
Logon User . . . . . . . . . . : Administrator
Logon Domain . . . . . . . . . : DOMAIN”.

I used the netdom utility to reset the domain membership and account. However, it was not useful. I checked the list of fixes in SP3 and recognized that DsGetDcName has some issues, which were fixes in SP3. My intention was not to install SP3 on my servers. If you did not install Service Pack 3, use the following: Upon continuing my search, I found and installed the ME321557 hotfix on all my domain controllers. After the reboot, I received Event ID 13565 in my File Replication log file. Once I waited a few minutes, the problem was resolved, and I received the following message in my File Replication Service log file: “The File Replication Service is no longer preventing the computer DC 2 from becoming a domain controller. The system volume has been successfully initialized and the Netlogon service has been notified that the system volume is now ready to be shared as SYSVOL. Type "net share" to check for the SYSVOL share”. The problem was solved successfully.
Recreate share in C:\WINNT\SYSVOL\sysvol and restart server.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...