DC Event warning 13508

  • Thread starter Thread starter Gordon
  • Start date Start date
G

Gordon

Greetings-

I have a rather simple, single domain with two DC's running fully
patched Windows 2000 Server and 3 other member servers, 2 of which are
running fully patched Windows 2000 Server and the other fully patched
Windows 2003 server (my exchange 2003 host).

One DC, shown as DC1 below in the event log text, has exactly one 13508
warning per day in the event log.

I've never seen a corresponding 13509 or 1265 event on either DC.

I've run the full series of tests using DcDiag and NetDiag and no
errors are reported in the resulting logs.

The SRV records appear to be correctly set on both DC's DNS.

The permissions on the Sysvol share are set correctly.

Time syncing is from DC1 and is functioning properly.

This one has me a bit baffled as I do not know what is causing the
event nor do I know if it is critical problem that needs to be
addressed or if it is something that is more of an annoyance event
warning than anything else.


Any thoughts, suggestions, troubleshooting ideas appreciated.
Thx
Gordon Pegue




Event Type: Warning
Event Source: NtFrs
Event Category: None
Event ID: 13508
Date: 1/8/2005
Time: 5:57:25 AM
User: N/A
Computer: DC1
Description:
The File Replication Service is having trouble enabling replication
from DC2 to DC1 for c:\winnt\sysvol\domain using the DNS name
DC2.cg-engrs.cg-engrs.com.

FRS will keep retrying.

Following are some of the reasons you would see this warning.

[1] FRS can not correctly resolve the DNS name
DC2.cg-engrs.cg-engrs.com from this computer.
[2] FRS is not running on DC2.cg-engrs.cg-engrs.com.
[3] The topology information in the Active Directory for this replica
has not yet replicated to all the Domain Controllers.

This event log message will appear once per connection.
After the problem is fixed you will see another event log message
indicating that the connection has been established.
 
 
Finally, yes. Pretty good tool but I'm mystified by the results.
I ran all tests and they reported as passed EXCEPT for the FRSDiag.txt
report, included here:

------------------------------------------------------------
FRSDiag v1.7 on 1/17/2005 3:56:20 PM
..\Logs\MORRISON on 2005-01-17 at 3.56.20 PM
------------------------------------------------------------

Checking for minimum FRS version requirement ... passed
Checking for errors/warnings in ntfrsutl ds ... passed
Checking for Replica Set configuration triggers... passed
Checking for suspicious file Backlog size... passed
Checking Overall Disk Space and SYSVOL structure (note: integrity is
not checked)... passed
Checking for suspicious inlog entries ... passed
Checking for suspicious outlog entries ... passed
Checking for appropriate staging area size ... passed
Checking for errors in debug logs ...
ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
2028: 895: S0: 15:47:07> :SR: Cmd 014c4c90, CxtG 74e60f44, WS
ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail -
Send Penalty]
ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
2028: 868: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail -
rpc call]
ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
2028: 895: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail -
Send Penalty]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that
DNS returns the IP address of the wrong computer. Check DNS records
being returned, Check if FRS is currently running on the target server.
Check if Ntfrs is registered with the End-Point-Mapper on target
server!)" : <SndCsMain: 1684: 874: S0: 17:59:47>
++ ERROR - EXCEPTION (000006d9) : WStatus: EPT_S_NOT_REGISTERED
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that
DNS returns the IP address of the wrong computer. Check DNS records
being returned, Check if FRS is currently running on the target server.
Check if Ntfrs is registered with the End-Point-Mapper on target
server!)" : <SndCsMain: 1684: 875: S0: 17:59:47>
:SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - rpc exception]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that
DNS returns the IP address of the wrong computer. Check DNS records
being returned, Check if FRS is currently running on the target server.
Check if Ntfrs is registered with the End-Point-Mapper on target
server!)" : <SndCsMain: 1684: 895: S0: 17:59:47>
:SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - Send Penalty]

Found 24404 ERROR_RETRY error(s)! Latest ones (up to 3) listed above
Found 3 EPT_S_NOT_REGISTERED error(s)! Latest ones (up to 3) listed
above

.......... failed with 24407 error entries
Checking NtFrs Service (and dependent services) state...passed
Checking NtFrs related Registry Keys for possible problems...passed
Checking Repadmin Showreps for errors...passed


So I attempted to find out more about the RPC End Point Mapper and came
up empty.

Any more ideas on how to run this down?

Thanks
Gordon
Have you tried to use the FRSDiag to troubleshoot?


br,
Denis

Gordon said:
Greetings-

I have a rather simple, single domain with two DC's running fully
patched Windows 2000 Server and 3 other member servers, 2 of which are
running fully patched Windows 2000 Server and the other fully patched
Windows 2003 server (my exchange 2003 host).

One DC, shown as DC1 below in the event log text, has exactly one 13508
warning per day in the event log.

I've never seen a corresponding 13509 or 1265 event on either DC.

I've run the full series of tests using DcDiag and NetDiag and no
errors are reported in the resulting logs.

The SRV records appear to be correctly set on both DC's DNS.

The permissions on the Sysvol share are set correctly.

Time syncing is from DC1 and is functioning properly.

This one has me a bit baffled as I do not know what is causing the
event nor do I know if it is critical problem that needs to be
addressed or if it is something that is more of an annoyance event
warning than anything else.


Any thoughts, suggestions, troubleshooting ideas appreciated.
Thx
Gordon Pegue




Event Type: Warning
Event Source: NtFrs
Event Category: None
Event ID: 13508
Date: 1/8/2005
Time: 5:57:25 AM
User: N/A
Computer: DC1
Description:
The File Replication Service is having trouble enabling replication
from DC2 to DC1 for c:\winnt\sysvol\domain using the DNS name
DC2.cg-engrs.cg-engrs.com.

FRS will keep retrying.

Following are some of the reasons you would see this warning.

[1] FRS can not correctly resolve the DNS name
DC2.cg-engrs.cg-engrs.com from this computer.
[2] FRS is not running on DC2.cg-engrs.cg-engrs.com.
[3] The topology information in the Active Directory for this replica
has not yet replicated to all the Domain Controllers.

This event log message will appear once per connection.
After the problem is fixed you will see another event log message
indicating that the connection has been established.
Click to expand...
Click to expand...
 
Anyone else have any ideas on this?

Gordon

Gordon said:
Finally, yes. Pretty good tool but I'm mystified by the results.
I ran all tests and they reported as passed EXCEPT for the FRSDiag.txt
report, included here:

------------------------------------------------------------
FRSDiag v1.7 on 1/17/2005 3:56:20 PM
.\Logs\MORRISON on 2005-01-17 at 3.56.20 PM
------------------------------------------------------------

Checking for minimum FRS version requirement ... passed
Checking for errors/warnings in ntfrsutl ds ... passed
Checking for Replica Set configuration triggers... passed
Checking for suspicious file Backlog size... passed
Checking Overall Disk Space and SYSVOL structure (note: integrity is
not checked)... passed
Checking for suspicious inlog entries ... passed
Checking for suspicious outlog entries ... passed
Checking for appropriate staging area size ... passed
Checking for errors in debug logs ...
ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
2028: 895: S0: 15:47:07> :SR: Cmd 014c4c90, CxtG 74e60f44, WS
ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail -
Send Penalty]
ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
2028: 868: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail -
rpc call]
ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
2028: 895: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail -
Send Penalty]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that
DNS returns the IP address of the wrong computer. Check DNS records
being returned, Check if FRS is currently running on the target server.
Check if Ntfrs is registered with the End-Point-Mapper on target
server!)" : <SndCsMain: 1684: 874: S0: 17:59:47>
++ ERROR - EXCEPTION (000006d9) : WStatus: EPT_S_NOT_REGISTERED
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that
DNS returns the IP address of the wrong computer. Check DNS records
being returned, Check if FRS is currently running on the target server.
Check if Ntfrs is registered with the End-Point-Mapper on target
server!)" : <SndCsMain: 1684: 875: S0: 17:59:47>
:SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - rpc exception]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that
DNS returns the IP address of the wrong computer. Check DNS records
being returned, Check if FRS is currently running on the target server.
Check if Ntfrs is registered with the End-Point-Mapper on target
server!)" : <SndCsMain: 1684: 895: S0: 17:59:47>
:SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - Send Penalty]

Found 24404 ERROR_RETRY error(s)! Latest ones (up to 3) listed above
Found 3 EPT_S_NOT_REGISTERED error(s)! Latest ones (up to 3) listed
above

......... failed with 24407 error entries
Checking NtFrs Service (and dependent services) state...passed
Checking NtFrs related Registry Keys for possible problems...passed
Checking Repadmin Showreps for errors...passed


So I attempted to find out more about the RPC End Point Mapper and came
up empty.

Any more ideas on how to run this down?

Thanks
Gordon
Have you tried to use the FRSDiag to troubleshoot?


br,
Denis
Click to expand...
which
are
running fully patched Windows 2000 Server and the other fully patched
Windows 2003 server (my exchange 2003 host).

One DC, shown as DC1 below in the event log text, has exactly one 13508
warning per day in the event log.

I've never seen a corresponding 13509 or 1265 event on either DC.

I've run the full series of tests using DcDiag and NetDiag and no
errors are reported in the resulting logs.

The SRV records appear to be correctly set on both DC's DNS.

The permissions on the Sysvol share are set correctly.

Time syncing is from DC1 and is functioning properly.

This one has me a bit baffled as I do not know what is causing the
event nor do I know if it is critical problem that needs to be
addressed or if it is something that is more of an annoyance event
warning than anything else.


Any thoughts, suggestions, troubleshooting ideas appreciated.
Thx
Gordon Pegue




Event Type: Warning
Event Source: NtFrs
Event Category: None
Event ID: 13508
Date: 1/8/2005
Time: 5:57:25 AM
User: N/A
Computer: DC1
Description:
The File Replication Service is having trouble enabling replication
from DC2 to DC1 for c:\winnt\sysvol\domain using the DNS name
DC2.cg-engrs.cg-engrs.com.

FRS will keep retrying.

Following are some of the reasons you would see this warning.

[1] FRS can not correctly resolve the DNS name
DC2.cg-engrs.cg-engrs.com from this computer.
[2] FRS is not running on DC2.cg-engrs.cg-engrs.com.
[3] The topology information in the Active Directory for this replica
has not yet replicated to all the Domain Controllers.

This event log message will appear once per connection.
After the problem is fixed you will see another event log message
indicating that the connection has been established.
Click to expand...
Click to expand...
Click to expand...
 
If you haven't already, have a look at this:
--
http://www.eventid.net/display.asp?eventid=13508&eventno=349&source=NtFrs&phase=1


--

Paul Williams

http://www.msresource.net
http://forums.msresource.net


Anyone else have any ideas on this?

Gordon

Gordon said:
Finally, yes. Pretty good tool but I'm mystified by the results.
I ran all tests and they reported as passed EXCEPT for the FRSDiag.txt
report, included here:

------------------------------------------------------------
FRSDiag v1.7 on 1/17/2005 3:56:20 PM
.\Logs\MORRISON on 2005-01-17 at 3.56.20 PM
------------------------------------------------------------

Checking for minimum FRS version requirement ... passed
Checking for errors/warnings in ntfrsutl ds ... passed
Checking for Replica Set configuration triggers... passed
Checking for suspicious file Backlog size... passed
Checking Overall Disk Space and SYSVOL structure (note: integrity is
not checked)... passed
Checking for suspicious inlog entries ... passed
Checking for suspicious outlog entries ... passed
Checking for appropriate staging area size ... passed
Checking for errors in debug logs ...
ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
2028: 895: S0: 15:47:07> :SR: Cmd 014c4c90, CxtG 74e60f44, WS
ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail -
Send Penalty]
ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
2028: 868: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail -
rpc call]
ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
2028: 895: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail -
Send Penalty]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that
DNS returns the IP address of the wrong computer. Check DNS records
being returned, Check if FRS is currently running on the target server.
Check if Ntfrs is registered with the End-Point-Mapper on target
server!)" : <SndCsMain: 1684: 874: S0: 17:59:47>
++ ERROR - EXCEPTION (000006d9) : WStatus: EPT_S_NOT_REGISTERED
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that
DNS returns the IP address of the wrong computer. Check DNS records
being returned, Check if FRS is currently running on the target server.
Check if Ntfrs is registered with the End-Point-Mapper on target
server!)" : <SndCsMain: 1684: 875: S0: 17:59:47>
:SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - rpc exception]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that
DNS returns the IP address of the wrong computer. Check DNS records
being returned, Check if FRS is currently running on the target server.
Check if Ntfrs is registered with the End-Point-Mapper on target
server!)" : <SndCsMain: 1684: 895: S0: 17:59:47>
:SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - Send Penalty]

Found 24404 ERROR_RETRY error(s)! Latest ones (up to 3) listed above
Found 3 EPT_S_NOT_REGISTERED error(s)! Latest ones (up to 3) listed
above

......... failed with 24407 error entries
Checking NtFrs Service (and dependent services) state...passed
Checking NtFrs related Registry Keys for possible problems...passed
Checking Repadmin Showreps for errors...passed


So I attempted to find out more about the RPC End Point Mapper and came
up empty.

Any more ideas on how to run this down?

Thanks
Gordon
Have you tried to use the FRSDiag to troubleshoot?


br,
Denis
Click to expand...
which
are
running fully patched Windows 2000 Server and the other fully patched
Windows 2003 server (my exchange 2003 host).

One DC, shown as DC1 below in the event log text, has exactly one 13508
warning per day in the event log.

I've never seen a corresponding 13509 or 1265 event on either DC.

I've run the full series of tests using DcDiag and NetDiag and no
errors are reported in the resulting logs.

The SRV records appear to be correctly set on both DC's DNS.

The permissions on the Sysvol share are set correctly.

Time syncing is from DC1 and is functioning properly.

This one has me a bit baffled as I do not know what is causing the
event nor do I know if it is critical problem that needs to be
addressed or if it is something that is more of an annoyance event
warning than anything else.


Any thoughts, suggestions, troubleshooting ideas appreciated.
Thx
Gordon Pegue




Event Type: Warning
Event Source: NtFrs
Event Category: None
Event ID: 13508
Date: 1/8/2005
Time: 5:57:25 AM
User: N/A
Computer: DC1
Description:
The File Replication Service is having trouble enabling replication
from DC2 to DC1 for c:\winnt\sysvol\domain using the DNS name
DC2.cg-engrs.cg-engrs.com.

FRS will keep retrying.

Following are some of the reasons you would see this warning.

[1] FRS can not correctly resolve the DNS name
DC2.cg-engrs.cg-engrs.com from this computer.
[2] FRS is not running on DC2.cg-engrs.cg-engrs.com.
[3] The topology information in the Active Directory for this replica
has not yet replicated to all the Domain Controllers.

This event log message will appear once per connection.
After the problem is fixed you will see another event log message
indicating that the connection has been established.
Click to expand...
Click to expand...
Click to expand...
 
Been there, done that, no help with the end point mapper issue that
appears to be the cause of the errors.

Gordon

If you haven't already, have a look at this:
--
http://www.eventid.net/display.asp?eventid=13508&eventno=349&source=NtFrs&phase=1


--

Paul Williams

http://www.msresource.net
http://forums.msresource.net


Anyone else have any ideas on this?

Gordon

Gordon said:
Finally, yes. Pretty good tool but I'm mystified by the results.
I ran all tests and they reported as passed EXCEPT for the FRSDiag.txt
report, included here:

------------------------------------------------------------
FRSDiag v1.7 on 1/17/2005 3:56:20 PM
.\Logs\MORRISON on 2005-01-17 at 3.56.20 PM
------------------------------------------------------------

Checking for minimum FRS version requirement ... passed
Checking for errors/warnings in ntfrsutl ds ... passed
Checking for Replica Set configuration triggers... passed
Checking for suspicious file Backlog size... passed
Checking Overall Disk Space and SYSVOL structure (note: integrity is
not checked)... passed
Checking for suspicious inlog entries ... passed
Checking for suspicious outlog entries ... passed
Checking for appropriate staging area size ... passed
Checking for errors in debug logs ...
ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
2028: 895: S0: 15:47:07> :SR: Cmd 014c4c90, CxtG 74e60f44, WS
ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370)
Click to expand...
[SndFail
-
Send Penalty]
ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
2028: 868: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370)
Click to expand...
[SndFail
-
rpc call]
ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
2028: 895: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370)
Click to expand...
[SndFail
-
Send Penalty]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that
DNS returns the IP address of the wrong computer. Check DNS records
being returned, Check if FRS is currently running on the target server.
Check if Ntfrs is registered with the End-Point-Mapper on target
server!)" : <SndCsMain: 1684: 874: S0: 17:59:47>
++ ERROR - EXCEPTION (000006d9) : WStatus: EPT_S_NOT_REGISTERED
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that
DNS returns the IP address of the wrong computer. Check DNS records
being returned, Check if FRS is currently running on the target server.
Check if Ntfrs is registered with the End-Point-Mapper on target
server!)" : <SndCsMain: 1684: 875: S0: 17:59:47>
:SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - rpc exception]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that
DNS returns the IP address of the wrong computer. Check DNS records
being returned, Check if FRS is currently running on the target server.
Check if Ntfrs is registered with the End-Point-Mapper on target
server!)" : <SndCsMain: 1684: 895: S0: 17:59:47>
:SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - Send Penalty]

Found 24404 ERROR_RETRY error(s)! Latest ones (up to 3) listed above
Found 3 EPT_S_NOT_REGISTERED error(s)! Latest ones (up to 3) listed
above

......... failed with 24407 error entries
Checking NtFrs Service (and dependent services) state...passed
Checking NtFrs related Registry Keys for possible problems...passed
Checking Repadmin Showreps for errors...passed


So I attempted to find out more about the RPC End Point Mapper and came
up empty.

Any more ideas on how to run this down?

Thanks
Gordon
Have you tried to use the FRSDiag to troubleshoot?


br,
Denis

:

Greetings-

I have a rather simple, single domain with two DC's running fully
patched Windows 2000 Server and 3 other member servers, 2 of
Click to expand...
which
are
running fully patched Windows 2000 Server and the other fully patched
Windows 2003 server (my exchange 2003 host).

One DC, shown as DC1 below in the event log text, has exactly
Click to expand...
one
13508
warning per day in the event log.

I've never seen a corresponding 13509 or 1265 event on either DC.

I've run the full series of tests using DcDiag and NetDiag and no
errors are reported in the resulting logs.

The SRV records appear to be correctly set on both DC's DNS.

The permissions on the Sysvol share are set correctly.

Time syncing is from DC1 and is functioning properly.

This one has me a bit baffled as I do not know what is causing the
event nor do I know if it is critical problem that needs to be
addressed or if it is something that is more of an annoyance event
warning than anything else.


Any thoughts, suggestions, troubleshooting ideas appreciated.
Thx
Gordon Pegue




Event Type: Warning
Event Source: NtFrs
Event Category: None
Event ID: 13508
Date: 1/8/2005
Time: 5:57:25 AM
User: N/A
Computer: DC1
Description:
The File Replication Service is having trouble enabling replication
from DC2 to DC1 for c:\winnt\sysvol\domain using the DNS name
DC2.cg-engrs.cg-engrs.com.

FRS will keep retrying.

Following are some of the reasons you would see this warning.

[1] FRS can not correctly resolve the DNS name
DC2.cg-engrs.cg-engrs.com from this computer.
[2] FRS is not running on DC2.cg-engrs.cg-engrs.com.
[3] The topology information in the Active Directory for this replica
has not yet replicated to all the Domain Controllers.

This event log message will appear once per connection.
After the problem is fixed you will see another event log message
indicating that the connection has been established.
Click to expand...
Click to expand...
Click to expand...
 
Apologies for the delay, I missed your last post!

So you're having RPC errors? This is usually indicative of DNS problems.

Try this:

-- Load the DNS snap-in and navigate down to the _msdcs dub-domain. Check
all entries in here to see if there are any rogue/ out-of-date entries, i.e.
incorrect server names, site names that don't correspond to current sites,
etc. If there are any suspect entries, delete them.
-- Point both DCs at one DC for DNS name-resolution.
-- Ensure that the DHCP client service is set to automatically start and is
running on both DCs.
-- Restart the netlogon service
-- Go make a cup of coffee.
-- Change the DNS settings back to what they were once were.

-- Flush the NtFrs event log.
-- Restart the NtFrs service
-- Run aforementioned tests again.

If, after this you're still getting NtFrs problems I'd perform a
non-authorative restore on the DC that is showing these errors. Post back
if you want help with this, but this is probably not the issue.

Are both of these DCs in the same site? If not, are they separated by a
firewall or intelligent device that can filter/ block ports and traffic?


--

Paul Williams

http://www.msresource.net
http://forums.msresource.net


Been there, done that, no help with the end point mapper issue that
appears to be the cause of the errors.

Gordon

If you haven't already, have a look at this:
--
http://www.eventid.net/display.asp?eventid=13508&eventno=349&source=NtFrs&phase=1


--

Paul Williams

http://www.msresource.net
http://forums.msresource.net


Anyone else have any ideas on this?

Gordon

Gordon said:
Finally, yes. Pretty good tool but I'm mystified by the results.
I ran all tests and they reported as passed EXCEPT for the FRSDiag.txt
report, included here:

------------------------------------------------------------
FRSDiag v1.7 on 1/17/2005 3:56:20 PM
.\Logs\MORRISON on 2005-01-17 at 3.56.20 PM
------------------------------------------------------------

Checking for minimum FRS version requirement ... passed
Checking for errors/warnings in ntfrsutl ds ... passed
Checking for Replica Set configuration triggers... passed
Checking for suspicious file Backlog size... passed
Checking Overall Disk Space and SYSVOL structure (note: integrity is
not checked)... passed
Checking for suspicious inlog entries ... passed
Checking for suspicious outlog entries ... passed
Checking for appropriate staging area size ... passed
Checking for errors in debug logs ...
ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
2028: 895: S0: 15:47:07> :SR: Cmd 014c4c90, CxtG 74e60f44, WS
ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370)
Click to expand...
[SndFail
-
Send Penalty]
ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
2028: 868: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370)
Click to expand...
[SndFail
-
rpc call]
ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
2028: 895: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370)
Click to expand...
[SndFail
-
Send Penalty]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that
DNS returns the IP address of the wrong computer. Check DNS records
being returned, Check if FRS is currently running on the target server.
Check if Ntfrs is registered with the End-Point-Mapper on target
server!)" : <SndCsMain: 1684: 874: S0: 17:59:47>
++ ERROR - EXCEPTION (000006d9) : WStatus: EPT_S_NOT_REGISTERED
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that
DNS returns the IP address of the wrong computer. Check DNS records
being returned, Check if FRS is currently running on the target server.
Check if Ntfrs is registered with the End-Point-Mapper on target
server!)" : <SndCsMain: 1684: 875: S0: 17:59:47>
:SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - rpc exception]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that
DNS returns the IP address of the wrong computer. Check DNS records
being returned, Check if FRS is currently running on the target server.
Check if Ntfrs is registered with the End-Point-Mapper on target
server!)" : <SndCsMain: 1684: 895: S0: 17:59:47>
:SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - Send Penalty]

Found 24404 ERROR_RETRY error(s)! Latest ones (up to 3) listed above
Found 3 EPT_S_NOT_REGISTERED error(s)! Latest ones (up to 3) listed
above

......... failed with 24407 error entries
Checking NtFrs Service (and dependent services) state...passed
Checking NtFrs related Registry Keys for possible problems...passed
Checking Repadmin Showreps for errors...passed


So I attempted to find out more about the RPC End Point Mapper and came
up empty.

Any more ideas on how to run this down?

Thanks
Gordon
Have you tried to use the FRSDiag to troubleshoot?


br,
Denis

:

Greetings-

I have a rather simple, single domain with two DC's running fully
patched Windows 2000 Server and 3 other member servers, 2 of
Click to expand...
which
are
running fully patched Windows 2000 Server and the other fully patched
Windows 2003 server (my exchange 2003 host).

One DC, shown as DC1 below in the event log text, has exactly
Click to expand...
one
13508
warning per day in the event log.

I've never seen a corresponding 13509 or 1265 event on either DC.

I've run the full series of tests using DcDiag and NetDiag and no
errors are reported in the resulting logs.

The SRV records appear to be correctly set on both DC's DNS.

The permissions on the Sysvol share are set correctly.

Time syncing is from DC1 and is functioning properly.

This one has me a bit baffled as I do not know what is causing the
event nor do I know if it is critical problem that needs to be
addressed or if it is something that is more of an annoyance event
warning than anything else.


Any thoughts, suggestions, troubleshooting ideas appreciated.
Thx
Gordon Pegue




Event Type: Warning
Event Source: NtFrs
Event Category: None
Event ID: 13508
Date: 1/8/2005
Time: 5:57:25 AM
User: N/A
Computer: DC1
Description:
The File Replication Service is having trouble enabling replication
from DC2 to DC1 for c:\winnt\sysvol\domain using the DNS name
DC2.cg-engrs.cg-engrs.com.

FRS will keep retrying.

Following are some of the reasons you would see this warning.

[1] FRS can not correctly resolve the DNS name
DC2.cg-engrs.cg-engrs.com from this computer.
[2] FRS is not running on DC2.cg-engrs.cg-engrs.com.
[3] The topology information in the Active Directory for this replica
has not yet replicated to all the Domain Controllers.

This event log message will appear once per connection.
After the problem is fixed you will see another event log message
indicating that the connection has been established.
Click to expand...
Click to expand...
Click to expand...
 
Back
Top