NTFRS Events 13552 & 13555

  • Thread starter Thread starter Johnny Red
  • Start date Start date
J

Johnny Red

Hi Saviours !

I have the following NTFRS events in Event viewer on a DC
which is also a GC/SM/DM/RID

Anybody had these before and can anybody suggest a
workaround ?

Thanks in advance to one and all !

Johnny Red
 
Some additional information will be needed to help you solve your problem.
First, are you running the latest FRS QFEs/SPs?

For W2K, that should be SP4 or Q815473.
For WS2K3, that should be Q823230

Event 13552 and 13555 have some more information in them. Would you forward
along the contents?

--Richard

Please post FRS related questions to microsoft.public.windows.server.dfs_frs
and prefix the subject line with "FRS:" to make it easier to spot. Note
that FRS is used to replicate SYSVOL on domain controllers and DFS root and
link targets.

For additional FRS resources, please visit http://www.microsoft.com/frs.

This posting is provided "AS IS" with no warranties, and confers no rights.
 
Hi Richard

Thanks for the response.

In answer to your query I'm running SP4 on all the DC's
however the DC with the NTFRS 13552 & 13555 issue has had
the Patch Q820888 applied bringing the ntfrs.sys file to
version 5.00.2195.6753.

The Q article you mention Q815473 would bring the
ntfrs.sys file up to version 5.0.2195.6763. Should I go
ahead and get the fix in Q815473 from Microsoft and apply
it in the hope it may resolve this issue ?

Also below are the clipboard dumps of the Events 13552 &
13555.

NB:I have not done the D2 authoritative restore as
suggested belwo as I read another article that said it is
important to figure out what the root cause of this proble
is prior to doing the D2 restore or the problem will
likely happen again.


Thanks once again in advance.

Johnny Red




Event 13552

Event Type: Error
Event Source: NtFrs
Event Category: None
Event ID: 13552
Date: 21/11/2003
Time: 12:38:27
User: N/A
Computer: ATFRDC01
Description:
The File Replication Service is unable to add this
computer to the following replica set:
"DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"

This could be caused by a number of problems such as:
-- an invalid root path,
-- a missing directory,
-- a missing disk volume,
-- a file system on the volume that does not support
NTFS 5.0

The information below may help to resolve the problem:
Computer DNS name is "ATFRDC01.angel-trains.com"
Replica set member name is "ATFRDC01"
Replica set root path is "c:\winnt\sysvol\domain"
Replica staging directory path
is "c:\winnt\sysvol\staging\domain"
Replica working directory path is "c:\winnt\ntfrs\jet"
Windows error status code is
FRS error status code is FrsErrorMismatchedJournalId

Other event log messages may also help determine the
problem. Correct the problem and the service will attempt
to restart replication automatically at a later time.


Event 13555


Event Type: Error
Event Source: NtFrs
Event Category: None
Event ID: 13555
Date: 21/11/2003
Time: 12:38:27
User: N/A
Computer: ATFRDC01
Description:
The File Replication Service is in an error state. Files
will not replicate to or from one or all of the replica
sets on this computer until the following recovery steps
are performed:

Recovery Steps:

[1] The error state may clear itself if you stop and
restart the FRS service. This can be done by performing
the following in a command window:

net stop ntfrs
net start ntfrs

If this fails to clear up the problem then proceed as
follows.

[2] For Active Directory Domain Controllers that DO NOT
host any DFS alternates or other replica sets with
replication enabled:

If there is at least one other Domain Controller in this
domain then restore the "system state" of this DC from
backup (using ntbackup or other backup-restore utility)
and make it non-authoritative.

If there are NO other Domain Controllers in this domain
then restore the "system state" of this DC from backup
(using ntbackup or other backup-restore utility) and
choose the Advanced option which marks the sysvols as
primary.

If there are other Domain Controllers in this domain but
ALL of them have this event log message then restore one
of them as primary (data files from primary will replicate
everywhere) and the others as non-authoritative.


[3] For Active Directory Domain Controllers that host DFS
alternates or other replica sets with replication enabled:

(3-a) If the Dfs alternates on this DC do not have any
other replication partners then copy the data under that
Dfs share to a safe location.
(3-b) If this server is the only Active Directory Domain
Controller for this domain then, before going to (3-c),
make sure this server does not have any inbound or
outbound connections to other servers that were formerly
Domain Controllers for this domain but are now off the net
(and will never be coming back online) or have been fresh
installed without being demoted. To delete connections use
the Sites and Services snapin and look for
Sites->NAME_OF_SITE->Servers->NAME_OF_SERVER->NTDS
Settings->CONNECTIONS.
(3-c) Restore the "system state" of this DC from backup
(using ntbackup or other backup-restore utility) and make
it non-authoritative.
(3-d) Copy the data from step (3-a) above to the original
location after the sysvol share is published.


[4] For other Windows 2000 servers:

(4-a) If any of the DFS alternates or other replica sets
hosted by this server do not have any other replication
partners then copy the data under its share or replica
tree root to a safe location.
(4-b) net stop ntfrs
(4-c) rd /s /q c:\winnt\ntfrs\jet
(4-d) net start ntfrs
(4-e) Copy the data from step (4-a) above to the
original location after the service has initialized (5
minutes is a safe waiting time).

Note: If this error message is in the eventlog of all the
members of a particular replica set then perform steps (4-
a) and (4-e) above on only one of the members.
 
To clarify, Q820888 is an NTFS QFE. NTFRS is FRS, and if you're already
running SP4, you don't need to apply Q815473. Q815473 and the FRS version
included in W2K SP4 are functionally equivalent.

The interesting thing here is that FRS uses the USN journal, something that
is affected by Q820888. I did a quick test and installed Q820888 without
any detrimental effects to FRS. Were you having troubles with your USN
journal that caused you to need to install Q820888? Was it installed around
the time when you started getting these FRS events?

Were any other changes made to your configuration or environment around the
time the events started popping up?

--Richard

Please post FRS related questions to microsoft.public.windows.server.dfs_frs
and prefix the subject line with "FRS:" to make it easier to spot. Note
that FRS is used to replicate SYSVOL on domain controllers and DFS root and
link targets.

For additional FRS resources, please visit http://www.microsoft.com/frs.

This posting is provided "AS IS" with no warranties, and confers no rights.

Johnny Red said:
Hi Richard

Thanks for the response.

In answer to your query I'm running SP4 on all the DC's
however the DC with the NTFRS 13552 & 13555 issue has had
the Patch Q820888 applied bringing the ntfrs.sys file to
version 5.00.2195.6753.

The Q article you mention Q815473 would bring the
ntfrs.sys file up to version 5.0.2195.6763. Should I go
ahead and get the fix in Q815473 from Microsoft and apply
it in the hope it may resolve this issue ?

Also below are the clipboard dumps of the Events 13552 &
13555.

NB:I have not done the D2 authoritative restore as
suggested belwo as I read another article that said it is
important to figure out what the root cause of this proble
is prior to doing the D2 restore or the problem will
likely happen again.


Thanks once again in advance.

Johnny Red




Event 13552

Event Type: Error
Event Source: NtFrs
Event Category: None
Event ID: 13552
Date: 21/11/2003
Time: 12:38:27
User: N/A
Computer: ATFRDC01
Description:
The File Replication Service is unable to add this
computer to the following replica set:
"DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"

This could be caused by a number of problems such as:
-- an invalid root path,
-- a missing directory,
-- a missing disk volume,
-- a file system on the volume that does not support
NTFS 5.0

The information below may help to resolve the problem:
Computer DNS name is "ATFRDC01.angel-trains.com"
Replica set member name is "ATFRDC01"
Replica set root path is "c:\winnt\sysvol\domain"
Replica staging directory path
is "c:\winnt\sysvol\staging\domain"
Replica working directory path is "c:\winnt\ntfrs\jet"
Windows error status code is
FRS error status code is FrsErrorMismatchedJournalId

Other event log messages may also help determine the
problem. Correct the problem and the service will attempt
to restart replication automatically at a later time.


Event 13555


Event Type: Error
Event Source: NtFrs
Event Category: None
Event ID: 13555
Date: 21/11/2003
Time: 12:38:27
User: N/A
Computer: ATFRDC01
Description:
The File Replication Service is in an error state. Files
will not replicate to or from one or all of the replica
sets on this computer until the following recovery steps
are performed:

Recovery Steps:

[1] The error state may clear itself if you stop and
restart the FRS service. This can be done by performing
the following in a command window:

net stop ntfrs
net start ntfrs

If this fails to clear up the problem then proceed as
follows.

[2] For Active Directory Domain Controllers that DO NOT
host any DFS alternates or other replica sets with
replication enabled:

If there is at least one other Domain Controller in this
domain then restore the "system state" of this DC from
backup (using ntbackup or other backup-restore utility)
and make it non-authoritative.

If there are NO other Domain Controllers in this domain
then restore the "system state" of this DC from backup
(using ntbackup or other backup-restore utility) and
choose the Advanced option which marks the sysvols as
primary.

If there are other Domain Controllers in this domain but
ALL of them have this event log message then restore one
of them as primary (data files from primary will replicate
everywhere) and the others as non-authoritative.


[3] For Active Directory Domain Controllers that host DFS
alternates or other replica sets with replication enabled:

(3-a) If the Dfs alternates on this DC do not have any
other replication partners then copy the data under that
Dfs share to a safe location.
(3-b) If this server is the only Active Directory Domain
Controller for this domain then, before going to (3-c),
make sure this server does not have any inbound or
outbound connections to other servers that were formerly
Domain Controllers for this domain but are now off the net
(and will never be coming back online) or have been fresh
installed without being demoted. To delete connections use
the Sites and Services snapin and look for
Sites->NAME_OF_SITE->Servers->NAME_OF_SERVER->NTDS
Settings->CONNECTIONS.
(3-c) Restore the "system state" of this DC from backup
(using ntbackup or other backup-restore utility) and make
it non-authoritative.
(3-d) Copy the data from step (3-a) above to the original
location after the sysvol share is published.


[4] For other Windows 2000 servers:

(4-a) If any of the DFS alternates or other replica sets
hosted by this server do not have any other replication
partners then copy the data under its share or replica
tree root to a safe location.
(4-b) net stop ntfrs
(4-c) rd /s /q c:\winnt\ntfrs\jet
(4-d) net start ntfrs
(4-e) Copy the data from step (4-a) above to the
original location after the service has initialized (5
minutes is a safe waiting time).

Note: If this error message is in the eventlog of all the
members of a particular replica set then perform steps (4-
a) and (4-e) above on only one of the members.

-----Original Message-----
Some additional information will be needed to help you solve your problem.
First, are you running the latest FRS QFEs/SPs?

For W2K, that should be SP4 or Q815473.
For WS2K3, that should be Q823230

Event 13552 and 13555 have some more information in them. Would you forward
along the contents?

--Richard

Please post FRS related questions to microsoft.public.windows.server.dfs_frs
and prefix the subject line with "FRS:" to make it easier to spot. Note
that FRS is used to replicate SYSVOL on domain controllers and DFS root and
link targets.

For additional FRS resources, please visit http://www.microsoft.com/frs.

This posting is provided "AS IS" with no warranties, and confers no rights.




.
Click to expand...
Click to expand...
 
Hi Richard

Thanks for the input.

Unfortunately I cannot get to the bottom of why Q820888
has been applied. I did the same test you did in our lab
and applied Q280888 but it did not have any detrimental
effect on FRS.

However on the download page for Q280888 it does state
that W2K SP4 is a supported operating system

I'm not keen just to remove Q280888 as a test as some
scary messages appear stating that one of the things that
could be affected by it's removal is the Dell Diak Array.

In the event viewer for 16/10/2003 there are some
spurious errors after the following QFE's were appllied.

KB823182
KB824141
KB824146
KB825119
KB828035
KB826232

eg Event viewer message NTFRS Event ID 13562 (Could not
find computer object for this computer.)

The server in question has had no other configuration
changes applied so my suspicions are that a hofix that
has been applied may have broken NTFRS.

If you can provide any other input I would be most
grateful.

Cheers

Johnny Red







-----Original Message-----
To clarify, Q820888 is an NTFS QFE. NTFRS is FRS, and if you're already
running SP4, you don't need to apply Q815473. Q815473 and the FRS version
included in W2K SP4 are functionally equivalent.

The interesting thing here is that FRS uses the USN journal, something that
is affected by Q820888. I did a quick test and installed Q820888 without
any detrimental effects to FRS. Were you having troubles with your USN
journal that caused you to need to install Q820888? Was it installed around
the time when you started getting these FRS events?

Were any other changes made to your configuration or environment around the
time the events started popping up?

--Richard

Please post FRS related questions to microsoft.public.windows.server.dfs_frs
and prefix the subject line with "FRS:" to make it easier to spot. Note
that FRS is used to replicate SYSVOL on domain controllers and DFS root and
link targets.

For additional FRS resources, please visit http://www.microsoft.com/frs.

This posting is provided "AS IS" with no warranties, and confers no rights.

Johnny Red said:
Hi Richard

Thanks for the response.

In answer to your query I'm running SP4 on all the DC's
however the DC with the NTFRS 13552 & 13555 issue has had
the Patch Q820888 applied bringing the ntfrs.sys file to
version 5.00.2195.6753.

The Q article you mention Q815473 would bring the
ntfrs.sys file up to version 5.0.2195.6763. Should I go
ahead and get the fix in Q815473 from Microsoft and apply
it in the hope it may resolve this issue ?

Also below are the clipboard dumps of the Events 13552 &
13555.

NB:I have not done the D2 authoritative restore as
suggested belwo as I read another article that said it is
important to figure out what the root cause of this proble
is prior to doing the D2 restore or the problem will
likely happen again.


Thanks once again in advance.

Johnny Red




Event 13552

Event Type: Error
Event Source: NtFrs
Event Category: None
Event ID: 13552
Date: 21/11/2003
Time: 12:38:27
User: N/A
Computer: ATFRDC01
Description:
The File Replication Service is unable to add this
computer to the following replica set:
"DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"

This could be caused by a number of problems such as:
-- an invalid root path,
-- a missing directory,
-- a missing disk volume,
-- a file system on the volume that does not support
NTFS 5.0

The information below may help to resolve the problem:
Computer DNS name is "ATFRDC01.angel-trains.com"
Replica set member name is "ATFRDC01"
Replica set root path is "c:\winnt\sysvol\domain"
Replica staging directory path
is "c:\winnt\sysvol\staging\domain"
Replica working directory path is "c:\winnt\ntfrs\jet"
Windows error status code is
FRS error status code is FrsErrorMismatchedJournalId

Other event log messages may also help determine the
problem. Correct the problem and the service will attempt
to restart replication automatically at a later time.


Event 13555


Event Type: Error
Event Source: NtFrs
Event Category: None
Event ID: 13555
Date: 21/11/2003
Time: 12:38:27
User: N/A
Computer: ATFRDC01
Description:
The File Replication Service is in an error state. Files
will not replicate to or from one or all of the replica
sets on this computer until the following recovery steps
are performed:

Recovery Steps:

[1] The error state may clear itself if you stop and
restart the FRS service. This can be done by performing
the following in a command window:

net stop ntfrs
net start ntfrs

If this fails to clear up the problem then proceed as
follows.

[2] For Active Directory Domain Controllers that DO NOT
host any DFS alternates or other replica sets with
replication enabled:

If there is at least one other Domain Controller in this
domain then restore the "system state" of this DC from
backup (using ntbackup or other backup-restore utility)
and make it non-authoritative.

If there are NO other Domain Controllers in this domain
then restore the "system state" of this DC from backup
(using ntbackup or other backup-restore utility) and
choose the Advanced option which marks the sysvols as
primary.

If there are other Domain Controllers in this domain but
ALL of them have this event log message then restore one
of them as primary (data files from primary will replicate
everywhere) and the others as non-authoritative.


[3] For Active Directory Domain Controllers that host DFS
alternates or other replica sets with replication enabled:

(3-a) If the Dfs alternates on this DC do not have any
other replication partners then copy the data under that
Dfs share to a safe location.
(3-b) If this server is the only Active Directory Domain
Controller for this domain then, before going to (3-c),
make sure this server does not have any inbound or
outbound connections to other servers that were formerly
Domain Controllers for this domain but are now off the net
(and will never be coming back online) or have been fresh
installed without being demoted. To delete connections use
the Sites and Services snapin and look for
Sites->NAME_OF_SITE->Servers->NAME_OF_SERVER->NTDS
Settings->CONNECTIONS.
(3-c) Restore the "system state" of this DC from backup
(using ntbackup or other backup-restore utility) and make
it non-authoritative.
(3-d) Copy the data from step (3-a) above to the original
location after the sysvol share is published.


[4] For other Windows 2000 servers:

(4-a) If any of the DFS alternates or other replica sets
hosted by this server do not have any other replication
partners then copy the data under its share or replica
tree root to a safe location.
(4-b) net stop ntfrs
(4-c) rd /s /q c:\winnt\ntfrs\jet
(4-d) net start ntfrs
(4-e) Copy the data from step (4-a) above to the
original location after the service has initialized (5
minutes is a safe waiting time).

Note: If this error message is in the eventlog of all the
members of a particular replica set then perform steps (4-
a) and (4-e) above on only one of the members.

-----Original Message-----
Some additional information will be needed to help you solve your problem.
First, are you running the latest FRS QFEs/SPs?

For W2K, that should be SP4 or Q815473.
For WS2K3, that should be Q823230

Event 13552 and 13555 have some more information in them. Would you forward
along the contents?

--Richard

Please post FRS related questions to microsoft.public.windows.server.dfs_frs
and prefix the subject line with "FRS:" to make it
Click to expand...
easier
to spot. Note
that FRS is used to replicate SYSVOL on domain controllers and DFS root and
link targets.

For additional FRS resources, please visit http://www.microsoft.com/frs.

This posting is provided "AS IS" with no warranties,
Click to expand...
and
confers no rights.
Hi Saviours !

I have the following NTFRS events in Event viewer
Click to expand...
on a
DC
which is also a GC/SM/DM/RID

Anybody had these before and can anybody suggest a
workaround ?

Thanks in advance to one and all !

Johnny Red


.
Click to expand...
Click to expand...


.
Click to expand...
 
Please repost to microsoft.public.windows.server.dfs_frs.

Try running DCDiag to make sure AD replication is working properly. With
all those networking changes, something else could be wrong and FRS is just
reacting to some other issue.

Lastly, would you post a copy of the 13552 event?

--Richard

Please post FRS related questions to microsoft.public.windows.server.dfs_frs
and prefix the subject line with "FRS:" to make it easier to spot. Note
that FRS is used to replicate SYSVOL on domain controllers and DFS root and
link targets.

For additional FRS resources, please visit http://www.microsoft.com/frs.

This posting is provided "AS IS" with no warranties, and confers no rights.

Larry Marcus said:
Richard:

It was interesting to hear all this because I have even read about FRS in
Click to expand...
detail and I am having similar problems on my PDC that has FSMO roles etc.
This happened after I had to change its static ip and DHCP etc in the other
domain controllers thereafter. I am still getting 13552 and 13555on this
server only. I am running 2000 with SP3. And I looked in the debug log and
found the Journal error i.e. id conflict and it cant start etc. I am sure
DNS is fine now but I am still getting these two errors and of course sysvol
wont do its thing. I dont think a service pack or fix will help ? or will
it and I am afraid I only have backup of this system with this error. Will
deleting the Ntfrs logs etc as in Eventid.net do the trick or am I in for
real trouble? Will NtFrs then restore itself? receive info from other Domain
controllers ?? I really do need some advice because this has been going on
for serveral weeks. If you could provide a way out of this morass I would
really appreciate it.
 
Back
Top