Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 13562 Source: NtFrs

Source
Level
Description
Following is the summary of warnings and errors encountered by File Replication Service while polling the Domain Controller <domain controller DNS name> for FRS replica set configuration information. Could not find computer object for this computer. Will try again at next polling cycle.
Comments
 
I had this error with a replica of DFS root. I tried removing the replica and re-adding it, but this did not seem to work. I removed the replica once more and waited this time for 4 hours to be sure AD had enough time to replicate the removal. Then I simply recreated the DFS replica and it worked. ME272279 helped in diagnosing the problems.
See WITP77493 for a solution to this problem.
In my case, the KCC (Knowledge Consistency Checker) created two entries for the same server. I followed the path to the NTDS Settings container and deleted the duplicate object.
I had this warning too. What I did was to set the property "frsMemberReference" for the "nTFRSSubscriber-Objekt" again. It was empty in my case. The "frsMemberReference" contains the same as the "frsComputerReferenceBL" of the Domain-Controller Object that the "nTFRSSubscriber-Objekt" belongs to.
Note that if you use dfsutil ("dfsutil /clean") to fix this problem, it can damage your DFS. It removes part of your computers registry so that you cannot read DFS with Administrative Tools - Distributed File System MMC. You should update dfsutil.exe with SP2 Support Tool; just follow the link below. While you are at it, you should install the SP3 Support Tool Pack, which does not update dfsutil.exe, but updates other Support Tools.


In my case this message appeared on the PDC before EventID 13501: "The File Replication Service is starting". See ME312862 and ME296183 for troubleshooting information.
A newsgroups post suggested the following article: ME260575 - "How to Use Netdom.exe to Reset Machine Account Passwords".
If the netdom fix of resetting the "secret" password does not work (ME260575) try the "dfsutil /clean:servername" command. See ME288399. This fix worked for me. Note that the warning message usually references a dfs root or share which has been deleted.
This can also occur if you have moved the computer account to a new OU in the domain. Until replication catches up this error should be benign.
Here is a solution that worked in my case. On the first occasion of this problem, the netdom resetpwd. (ME260575) fix worked. When it crept up again, and NETDOM did not work, I used the recommendations from a newsgrop post: LDP.EXE from the Support Tools off the W2K Server CD. I was actually able to fix this remotely from my desktop, but I'm sure it will work at the server as well. Follow the directions below. The Bind part was tricky, as my admin password did not allow me to "bind" with the server, but when I used my own account (I am a Domain Admin), I was able to successfully bind to LDAP and delete the offending metadata. The original post:
"I managed to get rid of these errors using ldp.exe from the support tools folder on the W2K Server CD. Once installed Go to Connect and type in the Server Name, then Bind and put in the Admistrator account (note: may have to try different accounts to authenticate, I did. As per MS, uncheck "connectionless"). After these I went to Browse then Delete and copied the path from the Event Log error eg. cn=a86844f0-0c1e-4091-9109-1b82d5decb5d, cn=dfs volumes, cn=ntfrs subscriptions, etc."
If you delete a DFS root OR delete some replicas using the "users and equipment" tool in the advanced view, you must delete the replica object using the LDAP tool in the resource kit to avoid the warning. See the ldap object description and browse the AD with the LDAP browser until the refrenced object. Here you can delete the object. Stop and restart the NTFRS service and see that the warning dissapear.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...