Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
The file replication service cannot replicate d:\winnt\sysvol\domain with the computer DC1 because the computer SID cannot be determined from the distinguished name "cn=dc1,ou=domain controller,dc=corp,dc=com" The file Replication Service will try later. SYSVOL and DFS content is not being replicated.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is the role of File Replication Service?
What is DFS?
This event may also be symptomatic to other problems. I recently used Acronis MigrateEasy to move the C: partition of a W2K domain controller from my small and elderly hard drive onto a larger faster hard drive. The disk image and migration went very smoothly, so I did not have any immediate evidence that anything was amiss until I began receiving a number of these events, along with EventID 1000 from source Userenv. Further, I could no longer force replication between the migrated DC and its "partner" DC, although both DCs were shown in the AD sites section of the MMC.
In order to clear up the problem, I had to demote the migrated DC to a member server, clean up the metadata on the replication partner, then promote the migrated DC and restore the replication links. The entire process is documented within TechNet Active Directory Operations Guide, Appendix B. After about 24 hours, all error messages tapered off and disappeared.
Apparently, this problem occurs if FRS failed to access a domain controller within a File Replication polling interval (5 min by default). The reason for this could be a domain controller becoming unreachable, network problems, etc.. Microsoft suggests that the File Replication Service should be restarted. See ME253859 for more details.
|Private comment: Subscribers only. See example of private comment|
|Links: ME253859, TechNet Active Directory Operations Guide Appendix B|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated