Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
The File Replication Service is in an error state. Files will not replicate to or from one or all of the replica sets on his computer until the following recovery steps are performed:
 The error state may clear itself if you stop and restart the FRS service. This can be done by performing the following in a command window:
net stop ntfrs
net start ntfrs
If this fails to clear up the problem then proceed as follows.
 For Active Directory Domain Controllers that DO NOT host any DFS alternates or other replica sets with replication enabled:
If there is at least one other Domain Controller in this domain then restore the "system state" of this DC from backup (using ntbackup or other backup-restore utility) and make it non-authoritative.
If there are NO other Domain Controllers in this domain then restore the "system state" of this DC from backup (using ntbackup or other backup-restore utility) and choose the Advanced option which marks the sysvols as primary.
If there are other Domain Controllers in this domain but ALL of them have this event log message then restore one of them as primary (data files from primary will replicate everywhere) and the others as non-authoritative.
 For Active Directory Domain Controllers that host DFS alternates or other replica sets with replication enabled:
(3-a) If the Dfs alternates on this DC do not have any other replication partners then copy the data under that Dfs share to a safe location.
(3-b) If this server is the only Active Directory Domain Controller for this domain then before going to (3-c) make sure this server does not have any inbound or outbound connections to other servers that were formerly Domain Controllers for this domain but are now off the net (and will never be coming back online) or have been fresh installed without being demoted. To delete connections use the Sites and Services snapin and look for
(3-c) Restore the "system state" of this DC from backup (using ntbackup or other backup-restore utility) and make it non-authoritative.
(3-d) Copy the data from step (3-a) above to the original location after the sysvol share is published.
 For other Windows 2000 servers:
(4-a) If any of the DFS alternates or other replica sets hosted by this server do not have any other replication partners then copy the data under its share or replica tree root to a safe location.
(4-b) net stop ntfrs
(4-c) rd /s /q g:\winnt\ntfrs\jet
(4-d) net start ntfrs
(4-e) Copy the data from step (4-a) above to the original location after the service has initialized (5 minutes is a safe waiting time).
Note: If this error message is in the eventlog of all the members of a particular replica set then perform steps (4-a) and (4-e) above on only one of the members.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is the role of File Replication Service?
What is DFS?
What is a replica set?
This problem occurs when a file ID for data in the FRS database does not match the file ID for the data in the update sequence number (USN) journal database. See ME925633 to solve this problem.
Microsoft article ME324939 also has information about this event.
Deleting the Jet data files does solve this problem. However, you should be aware that rebuilding these files will cause the replicated directory on the server to be rebuilt from scratch. This can take quite a long time depending on the size of your dfs root. Make sure you are familiar with Event ID 13520 before using this solution.
Peter Van den Bossche
I received this error together with EventID 13552 from source NtFrs. I found out that there was only 140 MB of free space on the system partition. Removing some data and restarting the File Replication Service cleared the problem for me.
This problem may occur after you apply the fix that is described in the following Microsoft Knowledge Base article ME811370. See ME819268 and ME823230 for details on this issue.
From a newsgroup post: "I was having similar problems with FRS on Win2k, namely event 13506 followed by 13555. Microsoft Tech support sent me a Hotfix that seems to have resolved this issue. I was also informed that the fix would be included in SP3. Info on what is addressed in the hotfix/SP3 can be found in ME307319".
This problem can also be caused by an Antivirus that scans the NtFrs database and corrupts it. Disable the Antivirus software from checking the NtFrs folder.
As per Microsoft: "This issue can occur if the FRS Jet database or one of its logs has been corrupted.". The ME264607 detailing the problem has been removed from Microsoft's site. This probably means that the information was not really accurate. Here is a summary of the article:
"Microsoft Knowledge Base Article ME264607 - Event ID 13507, 13552, and 13555 Messages Occur in the Domain Controller
In a Microsoft Windows 2000 domain controller with Microsoft Terminal Services installed in application server mode, errors may be displayed in the System event log. Cause: When you install Citrix MetaFrame Server version 1.8 on a Windows 2000 domain controller, you are prompted to re-map the server's drive letters (C-M), so that clients do not confuse their drive C with the server's drive C. When the drive is remapped, File Replication service (FRS) does not work correctly; FRS looks for drive letters that no longer exist. (updated 8/31/2000)".
The suggested solution:
1. Install another computer with Windows 2000 Server, and promote it as a domain controller.
2. Use "Dcpromo.exe", in order to downgrade the domain controller on which Citrix MetaFrame was installed, to a member server of the domain.
3. Use "Dcpromo.exe", in order to upgrade the member server again to a domain controller. In this way, the system files are rebuilt.
4. Stop NetLogon and the replication on the new domain controller.
5. Delete the file "Ntfrs.jdb" from the <windir>\Ntfrs\Jet directory.
6. Delete the file "Edb.txt" from the file <windir>\Ntfrs\Jet\Sys
7. Delete the file "Edb.txt", from the file "Res1.txt" and the file "Res2.txt" from the <windir>\Ntfrs\Jet\Log directory.
8. Restart the domain controller.
This could be caused by a number of problems such as:
an invalid root path,
a missing directory,
a missing disk volume,
a file system on the volume that does not support NTFS 5.0
The information below may help to resolve the problem:
computer DNS name is "test.Win.com"
Replica set member name is "TEST"
Replica set root path is "E:\Winnt\Sysvol\Domain"
Replica staging directory path is "E:\Winnt\Sysvol\Staging\Domain"
Replica working directory path is "O:\Winnt\Ntfrs\Jet"
Windows error status code is
FRS error status code is FrsErrorStageDirOpenFail
AND/OR the event error/NtFrs/13552.
The most likely cause of these errors is that the FRS Jet database, or a Jet database log file, is corrupt. To fix the problem:
1. Open a CMD prompt on the domain controller and stop the NetLogon and Ntfrs services:
net stop NetLogon
net stop Ntfrs
net start NetLogon
net start Ntfrs
4. Check the FRS event log for expected warning 13514 and 13520.
5. Close the FRS event log and go get a cup of coffee.
6. In five minutes, recheck the FRS event log for informational messages 13553, 13554, and 13516.
|Private comment: Subscribers only. See example of private comment|
|Links: ME264607, ME307319, ME324939, ME811370, ME819268, ME823230, ME925633, EventID 13520 from source NtFrs, EventID 13552 from source NtFrs|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (1) - More links...|
Send comments or solutions
- Notify me when updated