Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 13552 Source: NtFrs

The File Replication Service is unable to add this computer to the following replica set: "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
This problem occurs when a file ID for data in the FRS database does not match the file ID for the data in the update sequence number (USN) journal database. See ME925633 for information on fixing this problem.
I was getting this event along with event 13555 and the problem was solved by recreating the Jet folder. Please follow JSI Tip 3605 for details.
As per Microsoft: "This behavior can occur if the computer does not have the right to rename the volume label. This behavior can occur if improper permissions are set on the drive, or if the read-only flag is set on the root of the volume". See ME272946 to resolve this problem.

Insufficient hard disk space can also cause this event to appear. See ME889655 for more information.
I had this problem and tried all solutions with no effect until I found ME819268 that indicated at least 512 MB of free space is required for the process. Did some cleanup and everything worked fine after that.
As per Microsoft: "This issue can occur if the FRS Jet database or one of its logs has been corrupted.". The ME264607 article describing this error was removed from Microsoft's site. The article said:
"In a Microsoft Windows 2000 domain controller with Microsoft Terminal Services installed in application server mode, errors may be displayed in the System event log.
Cause: When you install Citrix MetaFrame Server version 1.8 on a Windows 2000 domain controller, you are prompted to re-map the server's drive letters (C-M), so that clients do not confuse their drive C with the server's drive C. When the drive is remapped, File Replication service (FRS) does not work correctly; FRS looks for drive letters that no longer exist."

This could be caused by a number of problems such as:
- an invalid root path,
- a missing directory,
- a missing disk volume,
- a file system on the volume that does not support NTFS 5.0
The information below may help to resolve the problem:
- computer DNS name is ""
- Replica set member name is "TEST"
- Replica set root path is "E:\Winnt\Sysvol\Domain"
- Replica staging directory path is "E:\Winnt\Sysvol\Staging\Domain"
- Replica working directory path is "O:\Winnt\Ntfrs\Jet"
- Windows error status code is
- FRS error status code is FrsErrorStageDirOpenFail
and/or the event error/NtFrs/13555.

The most likely cause of these errors is that the FRS Jet database, or a Jet database log file, is corrupt. To fix the problem:
1. Open a CMD prompt on the domain controller and stop the NetLogon and Ntfrs services:
    net stop NetLogon
    net stop Ntfrs
2. Type:
    del %systemroot%\ntfrs\jet\Ntfrs.jdb
    del %systemroot%\ntfrs\jet\Sys\Edb.chk
    del %systemroot%\ntfrs\jet\log\edb.log
    del %systemroot%\ntfrs\jet\log\res1.log
    del %systemroot%\ntfrs\jet\log\res2.log
3. Type:
    net start NetLogon
    net start Ntfrs
4. Check the FRS event log for expected warning 13514 and 13520.
5. Close the FRS event log and go get a cup of coffee.
6. In five minutes, recheck the FRS event log for informational messages 13553, 13554, and 13516.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.