Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 13555 Source: NtFrs

Source
Level
Description
The File Replication Service is in an error state. Files will not replicate to or from one or all of the replica sets on his computer until the following recovery steps are performed:

Recovery Steps:

[1] The error state may clear itself if you stop and restart the FRS service. This can be done by performing the following in a command window:

    net stop ntfrs
    net start ntfrs

If this fails to clear up the problem then proceed as follows.

[2] For Active Directory Domain Controllers that DO NOT host any DFS alternates or other replica sets with replication enabled:

If there is at least one other Domain Controller in this domain then restore the "system state" of this DC from backup (using ntbackup or other backup-restore utility) and make it non-authoritative.

If there are NO other Domain Controllers in this domain then restore the "system state" of this DC from backup (using ntbackup or other backup-restore utility) and choose the Advanced option which marks the sysvols as primary.

If there are other Domain Controllers in this domain but ALL of them have this event log message then restore one of them as primary (data files from primary will replicate everywhere) and the others as non-authoritative.


[3] For Active Directory Domain Controllers that host DFS alternates or other replica sets with replication enabled:

(3-a) If the Dfs alternates on this DC do not have any other replication partners then copy the data under that Dfs share to a safe location.
(3-b) If this server is the only Active Directory Domain Controller for this domain then before going to (3-c)  make sure this server does not have any inbound or outbound connections to other servers that were formerly Domain Controllers for this domain but are now off the net (and will never be coming back online) or have been fresh installed without being demoted. To delete connections use the Sites and Services snapin and look for
Sites->NAME_OF_SITE->Servers->NAME_OF_SERVER->NTDS Settings->CONNECTIONS.
(3-c) Restore the "system state" of this DC from backup (using ntbackup or other backup-restore utility) and make it non-authoritative.
(3-d) Copy the data from step (3-a) above to the original location after the sysvol share is published.


[4] For other Windows 2000 servers:

(4-a)  If any of the DFS alternates or other replica sets hosted by this server do not have any other replication partners then copy the data under its share or replica tree root to a safe location.
(4-b)  net stop ntfrs
(4-c)  rd /s /q  g:\winnt\ntfrs\jet
(4-d)  net start ntfrs
(4-e)  Copy the data from step (4-a) above to the original location after the service has initialized (5 minutes is a safe waiting time).

Note: If this error message is in the eventlog of all the members of a particular replica set then perform steps (4-a) and (4-e) above on only one of the members.
Comments
 
This problem occurs when a file ID for data in the FRS database does not match the file ID for the data in the update sequence number (USN) journal database. See ME925633 to solve this problem.

Microsoft article ME324939 also has information about this event.
Deleting the Jet data files does solve this problem. However, you should be aware that rebuilding these files will cause the replicated directory on the server to be rebuilt from scratch. This can take quite a long time depending on the size of your dfs root. Make sure you are familiar with Event ID 13520 before using this solution.
This problem may occur after you apply the fix that is described in the following Microsoft Knowledge Base article ME811370. See ME819268 and ME823230 for details on this issue.

From a newsgroup post: "I was having similar problems with FRS on Win2k, namely event 13506 followed by 13555. Microsoft Tech support sent me a Hotfix that seems to have resolved this issue. I was also informed that the fix would be included in SP3. Info on what is addressed in the hotfix/SP3 can be found in ME307319".
I received this error together with EventID 13552 from source NtFrs. I found out that there was only 140 MB of free space on the system partition. Removing some data and restarting the File Replication Service cleared the problem for me.
This problem can also be caused by an Antivirus that scans the NtFrs database and corrupts it. Disable the Antivirus software from checking the NtFrs folder.


As per Microsoft: "This issue can occur if the FRS Jet database or one of its logs has been corrupted.". The ME264607 detailing the problem has been removed from Microsoft's site. This probably means that the information was not really accurate. Here is a summary of the article:
"Microsoft Knowledge Base Article ME264607 - Event ID 13507, 13552, and 13555 Messages Occur in the Domain Controller
In a Microsoft Windows 2000 domain controller with Microsoft Terminal Services installed in application server mode, errors may be displayed in the System event log. Cause: When you install Citrix MetaFrame Server version 1.8 on a Windows 2000 domain controller, you are prompted to re-map the server's drive letters (C-M), so that clients do not confuse their drive C with the server's drive C. When the drive is remapped, File Replication service (FRS) does not work correctly; FRS looks for drive letters that no longer exist. (updated 8/31/2000)".

The suggested solution:
1. Install another computer with Windows 2000 Server, and promote it as a domain controller.
2. Use "Dcpromo.exe", in order to downgrade the domain controller on which Citrix MetaFrame was installed, to a member server of the domain.
3. Use "Dcpromo.exe", in order to upgrade the member server again to a domain controller. In this way, the system files are rebuilt.
4. Stop NetLogon and the replication on the new domain controller.
5. Delete the file "Ntfrs.jdb" from the <windir>\Ntfrs\Jet directory.
6. Delete the file "Edb.txt" from the file <windir>\Ntfrs\Jet\Sys
7. Delete the file "Edb.txt",   from the file "Res1.txt" and the file "Res2.txt" from the <windir>\Ntfrs\Jet\Log directory.
8. Restart the domain controller.
This could be caused by a number of problems such as:
             an invalid root path,
             a missing directory,
             a missing disk volume,
             a file system on the volume that does not support NTFS 5.0
             The information below may help to resolve the problem:
             computer DNS name is "test.Win.com"
             Replica set member name is "TEST"
             Replica set root path is "E:\Winnt\Sysvol\Domain"
             Replica staging directory path is "E:\Winnt\Sysvol\Staging\Domain"
             Replica working directory path is "O:\Winnt\Ntfrs\Jet"
             Windows error status code is
             FRS error status code is FrsErrorStageDirOpenFail

AND/OR the event error/NtFrs/13552.

The most likely cause of these errors is that the FRS Jet database, or a Jet database log file, is corrupt. To fix the problem:
1. Open a CMD prompt on the domain controller and stop the NetLogon and Ntfrs services:

    net stop NetLogon
    net stop Ntfrs

2. Type:

    del %systemroot%\ntfrs\jet\Ntfrs.jdb
    del %systemroot%\ntfrs\jet\Sys\Edb.chk
    del %systemroot%\ntfrs\jet\log\edb.log
    del %systemroot%\ntfrs\jet\log\res1.log
    del %systemroot%\ntfrs\jet\log\res2.log

3. Type:

    net start NetLogon
    net start Ntfrs

4. Check the FRS event log for expected warning 13514 and 13520.

5. Close the FRS event log and go get a cup of coffee.

6. In five minutes, recheck the FRS event log for informational messages 13553, 13554, and 13516.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...