Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 13526 Source: NtFrs

The file replication service cannot replicate d:\winnt\sysvol\domain with the computer DC1 because the computer SID cannot be determined from the distinguished name "cn=dc1,ou=domain controller,dc=corp,dc=com" The file Replication Service will try later. SYSVOL and DFS content is not being replicated.
This event may also be symptomatic to other problems. I recently used Acronis MigrateEasy to move the C: partition of a W2K domain controller from my small and elderly hard drive onto a larger faster hard drive. The disk image and migration went very smoothly, so I did not have any immediate evidence that anything was amiss until I began receiving a number of these events, along with EventID 1000 from source Userenv. Further, I could no longer force replication between the migrated DC and its "partner" DC, although both DCs were shown in the AD sites section of the MMC.
In order to clear up the problem, I had to demote the migrated DC to a member server, clean up the metadata on the replication partner, then promote the migrated DC and restore the replication links. The entire process is documented within TechNet Active Directory Operations Guide, Appendix B. After about 24 hours, all error messages tapered off and disappeared.
Apparently, this problem occurs if FRS failed to access a domain controller within a File Replication polling interval (5 min by default). The reason for this could be a domain controller becoming unreachable, network problems, etc.. Microsoft suggests that the File Replication Service should be restarted. See ME253859 for more details.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.