Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 13566 Source: NtFrs

File Replication Service is scanning the data in the system volume. computer <domain name> cannot become a domain controller until this process is complete. The system volume will then be shared as SYSVOL.

To check for the SYSVOL share, at the command prompt, type:
net share

When File Replication Service completes the scanning process, the SYSVOL share will appear.

The initialization of the system volume can take some time. The time is dependent on the amount of data in the system volume.
The fix in this article worked great for me, ME316790. I had demoted a SBS2008 server that didnt replicate correctly to the new DC which was Windows 2012 standard. When I would try to open any AD tools I would get an error that said domain does not exist or Domain Controller could not be contacted.
In my case, the solution stated in “EventID 13555 from source NtFrs” helped me to resolve this problem. The solution in stated in the event’s description, more precisely steps 4-a to 4-e.
We had this error on a child domain DC that we recently restored from Windows Backup. The fix for us was a registry hack provided by MS. See ME316790 for details.
This event also occurs when a server is promoted to Domain Controller.
Check the network cable. In my case this event appeared when network cable was disconnected and there was Event ID 13 with the source E1000.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.