Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 13553 Source: NtFrs

Source
Level
Description
The File Replication Service successfully added this computer to the following replica set: DOMAIN SYSTEM VOLUME (SYSVOL SHARE) Information related to this event is shown below: Computer DNS name is descartes.altairtech.net Replica set member name is DESCARTES Replica set root path is c:\winnt\sysvol\domain Replica staging directory path is c:\winnt\sysvol\staging\domain Replica working directory path is c:\winnt\ntfrs\jet
Comments
 
At a remote site, a volume had it's drive letter reassigned, breaking DFS Replication. Clearing the local JET folder, updating registry keys under HKLM\CurrentControlSet and the other backup areas, then restarting the NTFRS service did not resolve the incorrect location. As we implemented a Domain Based root we discovered the AD Computer Object held information on the replication location and it was here that the information was being read.

There may be a command I am not aware of yet the solution for us was to edit the object using ADSIEdit. Navigate to:

CN=<ComputerObject>, CN=NTFRS Subscriptions, CN=DFS Volumes, CN=<DFS Tree GUID>, CN=<DFS Tree Name>, CN=<DFS Replication Target>

Under Properties edit the fRSRootPath and fRSStagingPath attributes to use the correct paths. Allow AD Replication of the object to the affeected computers site. Restart the services:

Net Stop NTFRS

Delete the %SystemRoot%\NTFRS\JET folder. Until this was performed it held onto the old information.  Remember this will cause a resync of DFS content essentially wiping current data and replicating it back in.

Net Start NTFRS

You will see some warnings (Event id 13520) that the preexisting files in every DFS target will be moved to NtFrs_PreExisting... followed by 13553 and 13554 to say that the Target has been added to the Replication set.
ME842162 provides information on this event.
See "Moving FRSStagingPath Requires Non-Authoritative Restoration (ME265085)".

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...