Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 13539 Source: NtFrs

The File Replication Service cannot replicate c:\data\docs because the pathname of the replicated directory is not the fully qualified pathname of an existing, accessible local directory.
At a remote site, a volume had it's drive letter reassigned, breaking DFS Replication. Clearing the local JET folder, updating registry keys under HKLM\CurrentControlSet and the other backup areas, then restarting the NTFRS service did not resolve the incorrect location. As we implemented a Domain Based root we discovered the AD Computer Object held information on the replication location and it was here that the information was being read.

There may be a command I am not aware of yet the solution for us was to edit the object using ADSIEdit. Navigate to:

CN=<ComputerObject>, CN=NTFRS Subscriptions, CN=DFS Volumes, CN=<DFS Tree GUID>, CN=<DFS Tree Name>, CN=<DFS Replication Target>

Under Properties edit the fRSRootPath and fRSStagingPath attributes to use the correct paths. Allow AD Replication of the object to the affeected computers site. Restart the services:

Net Stop NTFRS

Delete the %SystemRoot%\NTFRS\JET folder. Until this was performed it held onto the old information.  Remember this will cause a resync of DFS content essentially wiping current data and replicating it back in.

Net Start NTFRS

You will see some warnings (Event id 13520) that the preexisting files in every DFS target will be moved to NtFrs_PreExisting... followed by 13553 and 13554 to say that the Target has been added to the Replication set.
In one case, Dfs was configured on two servers running Windows 2000 Server SP4. This problem appeared because of someone in the past reconfiguring Dfs and moving the replicas to another drive letter. This drive letter named in the description was the original drive letter. I tried reconfiguring Dfs and moving the folder back to the original drive letter. I did this by removing the Dfs replica, un-sharing the folder, moving the folder to the other drive, sharing the folder again and re-adding the Dfs replica. This stopped this event from appearing but Dfs was still not replicating. Finally I had to remove the Dfs root replica and all Dfs folder replicas on my second server and re-add them. After a little while all Dfs replication succeeded.
From a newsgroup post: "Make sure the permissions on the destination server are granted for Server\SYSTEM (full control). You have to make sure that the Frs-Staging (usually on another drive) has also permissions to be created. For the replica in the registry, use AD users and computers and configure mmc to display users groups and computers as containers, then navigate your server until you find the NTFRS Subscriptions. You should be able to remove the DFS from there."

ME812487 gives an overview of DFS in Windows 2000.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.