Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
The File Replication Service is deleting this computer from the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" as an attempt to recover from the error state, Error status = FrsErrorSuccess At the next poll, which will occur in 5 minutes, this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is the role of File Replication Service?
What is a replica set?
I received this event on a Windows 2000 server after following ME887440 and rebooting. The server was migrated to ESX using the VMware migration tool so Iím sure that the volume serial number is at fault here. After waiting 5 minutes like the event said to do, I received two informational events: 13553 and 13516. Everything seems to be fine now.
I got this error as a result of replacing the system disk of a domain controller via a disk image (PowerQuest Drive Image). The new disk had a different volume serial number that caused NtFrs issues (error code FrsErrorMismatchedVolumeSerialNumber). Following the instructions in the message will cure the problem for you.
If you encountered event id 13568 and you created the registry key "Enable Journal Wrap Automatic Restore" this event will show up.
|Private comment: Subscribers only. See example of private comment|
|Links: ME887440, Event id 13568|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated