NTFRS errors

[Robert Tristram]

Hi



I'm hoping somone may be able to come up with a really simple answer to
what's proved to be a difficult problem so far...



I have two domain controllers in 2 sites. One is running 2003 and holds all
FSMO roles. The other is running Win2K. Both are GC's

I have the following errors on the 2003 server. I think they may all be
related:



NtFrs Event ID: 13568

I've tried all of the options listed in the repair to fix this and nothing
works.



I get

USERENV Event ID: 1030

Whenever I try to update group policies, or on the system whenever GP
refreshes. As far as I can tell, most of the GP's I have are refreshing.



I occasionally get:

LSASRV Event Category: SPNEGO (Negotiator) Event ID: 40961




On the 2000 server in the other site, I am getting the following error:

NtFrs Event ID: 13508





Both machines can correctly resolve each other via both UNC and FQN names.

Both machines can resolve the Sysvol share on the other.

Both machines have AD replicating properly.



I've run Netdiag and DCDiag on both machines. The 2000 server has the
following entry in DCDiag (the only (pertinent) error on both machines):



Starting test: frssysvol

There are errors after the SYSVOL has been shared.

The SYSVOL can prevent the AD from starting.

......................... Server2000 passed test frssysvol





It looks like the SYSVOL share is not replicating. I've checked that SYSTEM
has full access to the SYSVOL directories on both DC's.



Can anyone tell me how to resolve this issue? I'd love to get it solved
before Christmas so I can enjoy a holiday.

 

[Guest]

13568 is an NTFS Journal Wrap. NtFrs is no longer running, which means
SYSVOL is no longer replicating.

To fix this, do the following on the server that is logging this error:

-- Stop NtFrs (File Replication Service).
-- Change the following Registry value to D2 (Hex)
--
HKLM\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process\Burflags
-- Start NtFrs
-- Go and make a cup of coffee
-- Drink it
-- Check the logs; there should be a couple of info/ warning entries
stating that the replica set is rebuilding and that SYSVOL is now shared.


--

Paul Williams

http://www.msresource.net/
http://forums.msresource.net/