Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 13520 Source: NtFrs

Source
Level
Description
The File Replication Service moved the preexisting files in %1 to %2.

The File Replication Service may delete the files in %2 at any time. Files can be saved from deletion by copying them out of %2. Copying the files into %1 may lead to name conflicts if the files already exist on some other replicating partner.

In some cases, the File Replication Service may copy a file from %2 into %1 instead of replicating the file from some other replicating partner.

Space can be recovered at any time by deleting the files in %2.
Comments
 
At a remote site, a volume had it's drive letter reassigned, breaking DFS Replication. Clearing the local JET folder, updating registry keys under HKLM\CurrentControlSet and the other backup areas, then restarting the NTFRS service did not resolve the incorrect location. As we implemented a Domain Based root we discovered the AD Computer Object held information on the replication location and it was here that the information was being read.

There may be a command I am not aware of yet the solution for us was to edit the object using ADSIEdit. Navigate to:

CN=<ComputerObject>, CN=NTFRS Subscriptions, CN=DFS Volumes, CN=<DFS Tree GUID>, CN=<DFS Tree Name>, CN=<DFS Replication Target>

Under Properties edit the fRSRootPath and fRSStagingPath attributes to use the correct paths. Allow AD Replication of the object to the affeected computers site. Restart the services:

Net Stop NTFRS

Delete the %SystemRoot%\NTFRS\JET folder. Until this was performed it held onto the old information.  Remember this will cause a resync of DFS content essentially wiping current data and replicating it back in.

Net Start NTFRS

You will see some warnings (Event id 13520) that the preexisting files in every DFS target will be moved to NtFrs_PreExisting... followed by 13553 and 13554 to say that the Target has been added to the Replication set.
See EventID 13559 from source NtFrs for information on this problem. You should delete the folder "NtFrs_PreExisting___See_EventLog" as soon as possible in order to avoid any filename problems, if this issue reappears.
This event is generated when File Replication is configured for a share but that share already contains files. In order to accommodate the mirroring that will be done by replication, the existing files are moved to a hidden directory called NtFrs_PreExisting___ so they can be recovered later.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...