Discussion:
SYSVOL not replicating on 2003 DCs
(too old to reply)
Jason
2005-10-07 15:52:02 UTC
Permalink
I have three Windows 2003 DCs that are not replicating their SYSVOL shares.
If I stop and restart the File Replication Service or just reboot I see 13501
telling me the File Replication Service is starting and then I get 13562
telling me some warnings are about to appear. I then see 13508 saying "The
File Replication Service is having trouble enabling replication from SERVER2
to SERVER1 for c:\windows\sysvol\domain using the DNS name
server2.mydomain.com. FRS will keep retrying.
Following are some of the reasons you would see this warning.

[1] FRS can not correctly resolve the DNS name server2.mydomain.com from
this computer.
[2] FRS is not running on server2.mydomain.com.
[3] The topology information in the Active Directory for this replica has
not yet replicated to all the Domain Controllers."

I'm not seeing any DNS errors and all three servers can ping each other
using the NetBIOS name as well as the FQDN. The time on all three servers is
synched. I did a net time /setsntp:time.windows.com from serve1 and did a net
time \\server1 /set /y from server2 and server3. None of the servers has
multiple enabled NICs and they all point to each other for DNS resolution.
I'm not sure where to go from here. Any suggestions?

Here are some dcdiag and netdiag logs from the PDC emulator (server1):
dcdiag log (http://www.jasonsconsulting.com/dcdiag.txt)
netdiag log (http://www.jasonsconsulting.com/netdiag.txt)
repadmin log (http://www.jasonsconsulting.com/repadmin.txt)
WILDPACKET
2005-10-07 16:28:04 UTC
Permalink
Try to run SONAR.EXE Diagnostic Tool. I had some what similar issue and I
deleted the FRS Database fodler which the system automatically creates back
.. it sits here ...c:\windows\ntfrs\jet. I deleted the jet folder. All is
good for me now. Knock on wood.

I am not telling you to delete the jet folder on your DCs.
Post by Jason
I have three Windows 2003 DCs that are not replicating their SYSVOL shares.
If I stop and restart the File Replication Service or just reboot I see 13501
telling me the File Replication Service is starting and then I get 13562
telling me some warnings are about to appear. I then see 13508 saying "The
File Replication Service is having trouble enabling replication from SERVER2
to SERVER1 for c:\windows\sysvol\domain using the DNS name
server2.mydomain.com. FRS will keep retrying.
Following are some of the reasons you would see this warning.
[1] FRS can not correctly resolve the DNS name server2.mydomain.com from
this computer.
[2] FRS is not running on server2.mydomain.com.
[3] The topology information in the Active Directory for this replica has
not yet replicated to all the Domain Controllers."
I'm not seeing any DNS errors and all three servers can ping each other
using the NetBIOS name as well as the FQDN. The time on all three servers is
synched. I did a net time /setsntp:time.windows.com from serve1 and did a net
time \\server1 /set /y from server2 and server3. None of the servers has
multiple enabled NICs and they all point to each other for DNS resolution.
I'm not sure where to go from here. Any suggestions?
dcdiag log (http://www.jasonsconsulting.com/dcdiag.txt)
netdiag log (http://www.jasonsconsulting.com/netdiag.txt)
repadmin log (http://www.jasonsconsulting.com/repadmin.txt)
Johan Reuterhäll
2005-10-07 18:20:04 UTC
Permalink
Also try frsdiag tool which is very good.
http://www.microsoft.com/downloads/details.aspx?FamilyID=43cb658e-8553-4de7-811a-562563eb5ebf&displaylang=en
Post by WILDPACKET
Try to run SONAR.EXE Diagnostic Tool. I had some what similar issue and I
deleted the FRS Database fodler which the system automatically creates back
.. it sits here ...c:\windows\ntfrs\jet. I deleted the jet folder. All is
good for me now. Knock on wood.
I am not telling you to delete the jet folder on your DCs.
Post by Jason
I have three Windows 2003 DCs that are not replicating their SYSVOL shares.
If I stop and restart the File Replication Service or just reboot I see 13501
telling me the File Replication Service is starting and then I get 13562
telling me some warnings are about to appear. I then see 13508 saying "The
File Replication Service is having trouble enabling replication from SERVER2
to SERVER1 for c:\windows\sysvol\domain using the DNS name
server2.mydomain.com. FRS will keep retrying.
Following are some of the reasons you would see this warning.
[1] FRS can not correctly resolve the DNS name server2.mydomain.com from
this computer.
[2] FRS is not running on server2.mydomain.com.
[3] The topology information in the Active Directory for this replica has
not yet replicated to all the Domain Controllers."
I'm not seeing any DNS errors and all three servers can ping each other
using the NetBIOS name as well as the FQDN. The time on all three servers is
synched. I did a net time /setsntp:time.windows.com from serve1 and did a net
time \\server1 /set /y from server2 and server3. None of the servers has
multiple enabled NICs and they all point to each other for DNS resolution.
I'm not sure where to go from here. Any suggestions?
dcdiag log (http://www.jasonsconsulting.com/dcdiag.txt)
netdiag log (http://www.jasonsconsulting.com/netdiag.txt)
repadmin log (http://www.jasonsconsulting.com/repadmin.txt)
Jason
2005-10-07 19:22:03 UTC
Permalink
I downloaded SONAR and the frsdiag tool. SONAR doesn't seem to show me any
immediate problems. The status bar at the bottom shows it sucseeded against
all three DCs. I'm still going through all the frsdiag logs...
Post by Johan Reuterhäll
Also try frsdiag tool which is very good.
http://www.microsoft.com/downloads/details.aspx?FamilyID=43cb658e-8553-4de7-811a-562563eb5ebf&displaylang=en
Post by WILDPACKET
Try to run SONAR.EXE Diagnostic Tool. I had some what similar issue and I
deleted the FRS Database fodler which the system automatically creates back
.. it sits here ...c:\windows\ntfrs\jet. I deleted the jet folder. All is
good for me now. Knock on wood.
I am not telling you to delete the jet folder on your DCs.
Post by Jason
I have three Windows 2003 DCs that are not replicating their SYSVOL shares.
If I stop and restart the File Replication Service or just reboot I see 13501
telling me the File Replication Service is starting and then I get 13562
telling me some warnings are about to appear. I then see 13508 saying "The
File Replication Service is having trouble enabling replication from SERVER2
to SERVER1 for c:\windows\sysvol\domain using the DNS name
server2.mydomain.com. FRS will keep retrying.
Following are some of the reasons you would see this warning.
[1] FRS can not correctly resolve the DNS name server2.mydomain.com from
this computer.
[2] FRS is not running on server2.mydomain.com.
[3] The topology information in the Active Directory for this replica has
not yet replicated to all the Domain Controllers."
I'm not seeing any DNS errors and all three servers can ping each other
using the NetBIOS name as well as the FQDN. The time on all three servers is
synched. I did a net time /setsntp:time.windows.com from serve1 and did a net
time \\server1 /set /y from server2 and server3. None of the servers has
multiple enabled NICs and they all point to each other for DNS resolution.
I'm not sure where to go from here. Any suggestions?
dcdiag log (http://www.jasonsconsulting.com/dcdiag.txt)
netdiag log (http://www.jasonsconsulting.com/netdiag.txt)
repadmin log (http://www.jasonsconsulting.com/repadmin.txt)
Jason
2005-10-07 20:23:13 UTC
Permalink
One thing I just realized is two of the DCs are missing NETLOGON shares. I've
seen the sysvolready registry key to enable the sysvol share and I know
you're not supposed to share out netlogon and sysvol with windows explorer,
so is there a similar registry key for netlogon?
Post by Jason
I downloaded SONAR and the frsdiag tool. SONAR doesn't seem to show me any
immediate problems. The status bar at the bottom shows it sucseeded against
all three DCs. I'm still going through all the frsdiag logs...
Post by Johan Reuterhäll
Also try frsdiag tool which is very good.
http://www.microsoft.com/downloads/details.aspx?FamilyID=43cb658e-8553-4de7-811a-562563eb5ebf&displaylang=en
Post by WILDPACKET
Try to run SONAR.EXE Diagnostic Tool. I had some what similar issue and I
deleted the FRS Database fodler which the system automatically creates back
.. it sits here ...c:\windows\ntfrs\jet. I deleted the jet folder. All is
good for me now. Knock on wood.
I am not telling you to delete the jet folder on your DCs.
Post by Jason
I have three Windows 2003 DCs that are not replicating their SYSVOL shares.
If I stop and restart the File Replication Service or just reboot I see 13501
telling me the File Replication Service is starting and then I get 13562
telling me some warnings are about to appear. I then see 13508 saying "The
File Replication Service is having trouble enabling replication from SERVER2
to SERVER1 for c:\windows\sysvol\domain using the DNS name
server2.mydomain.com. FRS will keep retrying.
Following are some of the reasons you would see this warning.
[1] FRS can not correctly resolve the DNS name server2.mydomain.com from
this computer.
[2] FRS is not running on server2.mydomain.com.
[3] The topology information in the Active Directory for this replica has
not yet replicated to all the Domain Controllers."
I'm not seeing any DNS errors and all three servers can ping each other
using the NetBIOS name as well as the FQDN. The time on all three servers is
synched. I did a net time /setsntp:time.windows.com from serve1 and did a net
time \\server1 /set /y from server2 and server3. None of the servers has
multiple enabled NICs and they all point to each other for DNS resolution.
I'm not sure where to go from here. Any suggestions?
dcdiag log (http://www.jasonsconsulting.com/dcdiag.txt)
netdiag log (http://www.jasonsconsulting.com/netdiag.txt)
repadmin log (http://www.jasonsconsulting.com/repadmin.txt)
Todd J Heron
2005-10-07 21:41:46 UTC
Permalink
The Sysvol and Netlogon Shares Are Missing After You Restore a Domain
http://support.microsoft.com/?id=316790

Just to be sure, ensure there is no host-based firewall on the DC blocking
the NetBIOS ports and thet File and Printer Sharing hasn't been disabled on
the network interface.
--
Todd J Heron, MCSE
Windows Server 2003/2000/NT; CCA
----------------------------------------------------------------------------
This posting is provided "as is" with no warranties and confers no rights

"Jason" <***@discussions.microsoft.com> wrote in message news:1A65D0B4-ECBC-454B-9C00-***@microsoft.com...
One thing I just realized is two of the DCs are missing NETLOGON shares.
I've
seen the sysvolready registry key to enable the sysvol share and I know
you're not supposed to share out netlogon and sysvol with windows explorer,
so is there a similar registry key for netlogon?
Post by Jason
I downloaded SONAR and the frsdiag tool. SONAR doesn't seem to show me any
immediate problems. The status bar at the bottom shows it sucseeded against
all three DCs. I'm still going through all the frsdiag logs...
Post by Johan Reuterhäll
Also try frsdiag tool which is very good.
http://www.microsoft.com/downloads/details.aspx?FamilyID=43cb658e-8553-4de7-811a-562563eb5ebf&displaylang=en
Post by WILDPACKET
Try to run SONAR.EXE Diagnostic Tool. I had some what similar issue and I
deleted the FRS Database fodler which the system automatically creates back
.. it sits here ...c:\windows\ntfrs\jet. I deleted the jet folder.
All
is
good for me now. Knock on wood.
I am not telling you to delete the jet folder on your DCs.
Post by Jason
I have three Windows 2003 DCs that are not replicating their SYSVOL shares.
If I stop and restart the File Replication Service or just reboot I
see
13501
telling me the File Replication Service is starting and then I get 13562
telling me some warnings are about to appear. I then see 13508 saying "The
File Replication Service is having trouble enabling replication from SERVER2
to SERVER1 for c:\windows\sysvol\domain using the DNS name
server2.mydomain.com. FRS will keep retrying.
Following are some of the reasons you would see this warning.
[1] FRS can not correctly resolve the DNS name server2.mydomain.com from
this computer.
[2] FRS is not running on server2.mydomain.com.
[3] The topology information in the Active Directory for this replica has
not yet replicated to all the Domain Controllers."
I'm not seeing any DNS errors and all three servers can ping each other
using the NetBIOS name as well as the FQDN. The time on all three
servers
is
synched. I did a net time /setsntp:time.windows.com from serve1 and
did a
net
time \\server1 /set /y from server2 and server3. None of the servers has
multiple enabled NICs and they all point to each other for DNS resolution.
I'm not sure where to go from here. Any suggestions?
dcdiag log (http://www.jasonsconsulting.com/dcdiag.txt)
netdiag log (http://www.jasonsconsulting.com/netdiag.txt)
repadmin log (http://www.jasonsconsulting.com/repadmin.txt)
Jason
2005-10-07 23:31:09 UTC
Permalink
The SP1 firewall is disabled on all three servers and they are on the same LAN.

I ran FRSDiag and got LOTS of errors like:

Checking for errors/warnings in FRS Event Log ....
NtFrs 10/7/2005 5:19:49 PM Warning 13508 The message '-2147470140' for
application 'NtFrs' could not be formatted using library(ies):
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'SERVER1', 'SERVER2', 'c:\windows\sysvol\domain',
'server1.jasonsconsulting.com'
NtFrs 10/7/2005 5:19:49 PM Warning 13508 The message '-2147470140' for
application 'NtFrs' could not be formatted using library(ies):
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'SERVER3', 'SERVER2', 'c:\windows\sysvol\domain',
'server3.jasonsconsulting.com'
NtFrs 10/7/2005 5:18:09 PM Warning 13562 The message '-2147470086' for
application 'NtFrs' could not be formatted using library(ies):
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'server2.jasonsconsulting.com', ''
NtFrs 10/7/2005 4:01:28 PM Warning 13508 The message '-2147470140' for
application 'NtFrs' could not be formatted using library(ies):
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'SERVER3', 'SERVER2', 'c:\windows\sysvol\domain',
'server3.jasonsconsulting.com'

and...

NtFrs 10/6/2005 11:37:58 AM Error 13526 The message '-1073728298' for
application 'NtFrs' could not be formatted using library(ies):
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'c:\windows\sysvol\domain', 'SERVER1',
'cn=server1,ou=domain controllers,dc=jasonsconsulting,dc=com'
NtFrs 10/6/2005 11:37:58 AM Error 13526 The message '-1073728298' for
application 'NtFrs' could not be formatted using library(ies):
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'c:\windows\sysvol\domain', 'SERVER3',
'cn=server3,ou=domain controllers,dc=jasonsconsulting,dc=com'
NtFrs 10/6/2005 11:37:57 AM Error 13526 The message '-1073728298' for
application 'NtFrs' could not be formatted using library(ies):
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'c:\dfs', 'SERVER1', 'cn=server1,ou=domain
controllers,dc=jasonsconsulting,dc=com'

and...

WARNING: Found Event ID 13508 errors without trailing 13509 ... see above
for (up to) the 3 latest entries!

......... failed 26
Checking for errors in Directory Service Event Log ....
NTDS Replication 10/5/2005 9:45:23 AM Error 2042 The message '-1073739782'
for application 'NTDS Replication' could not be formatted using library(ies):
'C:\WINDOWS\system32\ntdsmsg.dll'. The log entry contains the following
replacement strings:'2004-09-13 09:39:48',
'02c3f6c8-f6b8-02c3-0100-000000000000',
'a5c882df-4abd-4def-9b1a-c5ab78bb1f90._msdcs.jasonsconsulting.com', '60',
'Allow Replication With Divergent and Corrupt Partner'

and...

Checking for errors/warnings in ntfrsutl ds ...
ERROR : missing Computer Ref for server
"{AA9B2ADC-18CB-4359-AA81-ADB7E625377B}"
Look for frsComputerReference on KB Article : 312862 Recovering Missing
FRS Objects and FRS Attributes in Active Directory
ERROR : missing Computer Ref for server
"{E5B78CBB-2668-405E-BAE2-C676ACCD8A0D}"
Look for frsComputerReference on KB Article : 312862 Recovering Missing
FRS Objects and FRS Attributes in Active Directory
......... failed with 2 error(s)
Checking for Replica Set configuration triggers... passed
Checking for suspicious file Backlog size...
ERROR : File Backlog TO server "DOMAIN\SERVER1$" is : 181 :: Unless this
is due to your schedule, this is a problem!
ERROR : File Backlog TO server "DOMAIN\SERVER3$" is : 181 :: Unless this
is due to your schedule, this is a problem!
failed with 2 error(s) and 0 warning(s)

and finally...

Checking for errors in debug logs ...
ERROR on NtFrs_0005.log : "ERROR_ACCESS_DENIED" : <SndCsMain:
6032: 904: S0: 17:18:38> :SR: Cmd 00f2d790, CxtG a5163363, WS
ERROR_ACCESS_DENIED, To server1.jasonsconsulting.com Len: (370) [SndFail -
Send Penalty]
ERROR on NtFrs_0005.log : "ERROR_ACCESS_DENIED" : <SndCsMain:
6032: 877: S0: 17:18:39> :SR: Cmd 00f2d790, CxtG b0cf9331, WS
ERROR_ACCESS_DENIED, To server1.jasonsconsulting.com Len: (368) [SndFail -
rpc call]
ERROR on NtFrs_0005.log : "ERROR_ACCESS_DENIED" : <SndCsMain:
6032: 904: S0: 17:18:39> :SR: Cmd 00f2d790, CxtG b0cf9331, WS
ERROR_ACCESS_DENIED, To server1.jasonsconsulting.com Len: (368) [SndFail -
Send Penalty]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that DNS
returns the IP address of the wrong computer. Check DNS records being
returned, Check if FRS is currently running on the target server. Check if
Ntfrs is registered with the End-Point-Mapper on target server!)" :
<SndCsMain: 1992: 883: S0: 17:18:09> ++ ERROR -
EXCEPTION (000006d9) : WStatus: EPT_S_NOT_REGISTERED
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that DNS
returns the IP address of the wrong computer. Check DNS records being
returned, Check if FRS is currently running on the target server. Check if
Ntfrs is registered with the End-Point-Mapper on target server!)" :
<SndCsMain: 1992: 884: S0: 17:18:09> :SR: Cmd 00f2d4d8,
CxtG b0cf9331, WS EPT_S_NOT_REGISTERED, To server1.jasonsconsulting.com
Len: (368) [SndFail - rpc exception]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that DNS
returns the IP address of the wrong computer. Check DNS records being
returned, Check if FRS is currently running on the target server. Check if
Ntfrs is registered with the End-Point-Mapper on target server!)" :
<SndCsMain: 1992: 904: S0: 17:18:09> :SR: Cmd 00f2d4d8,
CxtG b0cf9331, WS EPT_S_NOT_REGISTERED, To server1.jasonsconsulting.com
Len: (368) [SndFail - Send Penalty]
ERROR on NtFrs_0001.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was
established to target, but there was a failure to send RPC call package.
Check for Networking problems!)" : <SndCsMain: 5956:
883: S0: 20:40:59> ++ ERROR - EXCEPTION (000006bf) : WStatus:
RPC_S_CALL_FAILED_DNE
ERROR on NtFrs_0001.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was
established to target, but there was a failure to send RPC call package.
Check for Networking problems!)" : <SndCsMain: 5956:
884: S0: 20:40:59> :SR: Cmd 00f0bb10, CxtG a5163363, WS
RPC_S_CALL_FAILED_DNE, To server1.jasonsconsulting.com Len: (538) [SndFail
- rpc exception]
ERROR on NtFrs_0001.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was
established to target, but there was a failure to send RPC call package.
Check for Networking problems!)" : <SndCsMain: 5956:
904: S0: 20:40:59> :SR: Cmd 00f0bb10, CxtG a5163363, WS
RPC_S_CALL_FAILED_DNE, To server1.jasonsconsulting.com Len: (538) [SndFail
- Send Penalty]

Found 16 ERROR_ACCESS_DENIED error(s)! Latest ones (up to 3) listed above
Found 17 EPT_S_NOT_REGISTERED error(s)! Latest ones (up to 3) listed above
Found 3 RPC_S_CALL_FAILED_DNE error(s)! Latest ones (up to 3) listed above

......... failed with 36 error entries
Swedboy
2005-10-08 18:39:29 UTC
Permalink
You have three DC's... Do you have the same problem with replication on all
of them or is it just one that the replication is failing on?
Post by Jason
The SP1 firewall is disabled on all three servers and they are on the same LAN.
Checking for errors/warnings in FRS Event Log ....
NtFrs 10/7/2005 5:19:49 PM Warning 13508 The message '-2147470140' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'SERVER1', 'SERVER2', 'c:\windows\sysvol\domain',
'server1.jasonsconsulting.com'
NtFrs 10/7/2005 5:19:49 PM Warning 13508 The message '-2147470140' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'SERVER3', 'SERVER2', 'c:\windows\sysvol\domain',
'server3.jasonsconsulting.com'
NtFrs 10/7/2005 5:18:09 PM Warning 13562 The message '-2147470086' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'server2.jasonsconsulting.com', ''
NtFrs 10/7/2005 4:01:28 PM Warning 13508 The message '-2147470140' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'SERVER3', 'SERVER2', 'c:\windows\sysvol\domain',
'server3.jasonsconsulting.com'
and...
NtFrs 10/6/2005 11:37:58 AM Error 13526 The message '-1073728298' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'c:\windows\sysvol\domain', 'SERVER1',
'cn=server1,ou=domain controllers,dc=jasonsconsulting,dc=com'
NtFrs 10/6/2005 11:37:58 AM Error 13526 The message '-1073728298' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'c:\windows\sysvol\domain', 'SERVER3',
'cn=server3,ou=domain controllers,dc=jasonsconsulting,dc=com'
NtFrs 10/6/2005 11:37:57 AM Error 13526 The message '-1073728298' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'c:\dfs', 'SERVER1', 'cn=server1,ou=domain
controllers,dc=jasonsconsulting,dc=com'
and...
WARNING: Found Event ID 13508 errors without trailing 13509 ... see above
for (up to) the 3 latest entries!
......... failed 26
Checking for errors in Directory Service Event Log ....
NTDS Replication 10/5/2005 9:45:23 AM Error 2042 The message '-1073739782'
'C:\WINDOWS\system32\ntdsmsg.dll'. The log entry contains the following
replacement strings:'2004-09-13 09:39:48',
'02c3f6c8-f6b8-02c3-0100-000000000000',
'a5c882df-4abd-4def-9b1a-c5ab78bb1f90._msdcs.jasonsconsulting.com', '60',
'Allow Replication With Divergent and Corrupt Partner'
and...
Checking for errors/warnings in ntfrsutl ds ...
ERROR : missing Computer Ref for server
"{AA9B2ADC-18CB-4359-AA81-ADB7E625377B}"
Look for frsComputerReference on KB Article : 312862 Recovering Missing
FRS Objects and FRS Attributes in Active Directory
ERROR : missing Computer Ref for server
"{E5B78CBB-2668-405E-BAE2-C676ACCD8A0D}"
Look for frsComputerReference on KB Article : 312862 Recovering Missing
FRS Objects and FRS Attributes in Active Directory
......... failed with 2 error(s)
Checking for Replica Set configuration triggers... passed
Checking for suspicious file Backlog size...
ERROR : File Backlog TO server "DOMAIN\SERVER1$" is : 181 :: Unless this
is due to your schedule, this is a problem!
ERROR : File Backlog TO server "DOMAIN\SERVER3$" is : 181 :: Unless this
is due to your schedule, this is a problem!
failed with 2 error(s) and 0 warning(s)
and finally...
Checking for errors in debug logs ...
6032: 904: S0: 17:18:38> :SR: Cmd 00f2d790, CxtG a5163363, WS
ERROR_ACCESS_DENIED, To server1.jasonsconsulting.com Len: (370) [SndFail -
Send Penalty]
6032: 877: S0: 17:18:39> :SR: Cmd 00f2d790, CxtG b0cf9331, WS
ERROR_ACCESS_DENIED, To server1.jasonsconsulting.com Len: (368) [SndFail -
rpc call]
6032: 904: S0: 17:18:39> :SR: Cmd 00f2d790, CxtG b0cf9331, WS
ERROR_ACCESS_DENIED, To server1.jasonsconsulting.com Len: (368) [SndFail -
Send Penalty]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that DNS
returns the IP address of the wrong computer. Check DNS records being
returned, Check if FRS is currently running on the target server. Check if
<SndCsMain: 1992: 883: S0: 17:18:09> ++ ERROR -
EXCEPTION (000006d9) : WStatus: EPT_S_NOT_REGISTERED
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that DNS
returns the IP address of the wrong computer. Check DNS records being
returned, Check if FRS is currently running on the target server. Check if
<SndCsMain: 1992: 884: S0: 17:18:09> :SR: Cmd 00f2d4d8,
CxtG b0cf9331, WS EPT_S_NOT_REGISTERED, To server1.jasonsconsulting.com
Len: (368) [SndFail - rpc exception]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that DNS
returns the IP address of the wrong computer. Check DNS records being
returned, Check if FRS is currently running on the target server. Check if
<SndCsMain: 1992: 904: S0: 17:18:09> :SR: Cmd 00f2d4d8,
CxtG b0cf9331, WS EPT_S_NOT_REGISTERED, To server1.jasonsconsulting.com
Len: (368) [SndFail - Send Penalty]
ERROR on NtFrs_0001.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was
established to target, but there was a failure to send RPC call package.
RPC_S_CALL_FAILED_DNE
ERROR on NtFrs_0001.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was
established to target, but there was a failure to send RPC call package.
884: S0: 20:40:59> :SR: Cmd 00f0bb10, CxtG a5163363, WS
RPC_S_CALL_FAILED_DNE, To server1.jasonsconsulting.com Len: (538) [SndFail
- rpc exception]
ERROR on NtFrs_0001.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was
established to target, but there was a failure to send RPC call package.
904: S0: 20:40:59> :SR: Cmd 00f0bb10, CxtG a5163363, WS
RPC_S_CALL_FAILED_DNE, To server1.jasonsconsulting.com Len: (538) [SndFail
- Send Penalty]
Found 16 ERROR_ACCESS_DENIED error(s)! Latest ones (up to 3) listed above
Found 17 EPT_S_NOT_REGISTERED error(s)! Latest ones (up to 3) listed above
Found 3 RPC_S_CALL_FAILED_DNE error(s)! Latest ones (up to 3) listed above
......... failed with 36 error entries
Jason
2005-10-08 20:36:01 UTC
Permalink
This is happening on all three DCs. I can make user account changes (password
resets, account deletes, etc) and they get replicated to all three DCs just
fine. Only files in the SYSVOL and the NETLOGON shares will not replicate.
Post by Swedboy
You have three DC's... Do you have the same problem with replication on all
of them or is it just one that the replication is failing on?
Post by Jason
The SP1 firewall is disabled on all three servers and they are on the same LAN.
Checking for errors/warnings in FRS Event Log ....
NtFrs 10/7/2005 5:19:49 PM Warning 13508 The message '-2147470140' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'SERVER1', 'SERVER2', 'c:\windows\sysvol\domain',
'server1.jasonsconsulting.com'
NtFrs 10/7/2005 5:19:49 PM Warning 13508 The message '-2147470140' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'SERVER3', 'SERVER2', 'c:\windows\sysvol\domain',
'server3.jasonsconsulting.com'
NtFrs 10/7/2005 5:18:09 PM Warning 13562 The message '-2147470086' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'server2.jasonsconsulting.com', ''
NtFrs 10/7/2005 4:01:28 PM Warning 13508 The message '-2147470140' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'SERVER3', 'SERVER2', 'c:\windows\sysvol\domain',
'server3.jasonsconsulting.com'
and...
NtFrs 10/6/2005 11:37:58 AM Error 13526 The message '-1073728298' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'c:\windows\sysvol\domain', 'SERVER1',
'cn=server1,ou=domain controllers,dc=jasonsconsulting,dc=com'
NtFrs 10/6/2005 11:37:58 AM Error 13526 The message '-1073728298' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'c:\windows\sysvol\domain', 'SERVER3',
'cn=server3,ou=domain controllers,dc=jasonsconsulting,dc=com'
NtFrs 10/6/2005 11:37:57 AM Error 13526 The message '-1073728298' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'c:\dfs', 'SERVER1', 'cn=server1,ou=domain
controllers,dc=jasonsconsulting,dc=com'
and...
WARNING: Found Event ID 13508 errors without trailing 13509 ... see above
for (up to) the 3 latest entries!
......... failed 26
Checking for errors in Directory Service Event Log ....
NTDS Replication 10/5/2005 9:45:23 AM Error 2042 The message '-1073739782'
'C:\WINDOWS\system32\ntdsmsg.dll'. The log entry contains the following
replacement strings:'2004-09-13 09:39:48',
'02c3f6c8-f6b8-02c3-0100-000000000000',
'a5c882df-4abd-4def-9b1a-c5ab78bb1f90._msdcs.jasonsconsulting.com', '60',
'Allow Replication With Divergent and Corrupt Partner'
and...
Checking for errors/warnings in ntfrsutl ds ...
ERROR : missing Computer Ref for server
"{AA9B2ADC-18CB-4359-AA81-ADB7E625377B}"
Look for frsComputerReference on KB Article : 312862 Recovering Missing
FRS Objects and FRS Attributes in Active Directory
ERROR : missing Computer Ref for server
"{E5B78CBB-2668-405E-BAE2-C676ACCD8A0D}"
Look for frsComputerReference on KB Article : 312862 Recovering Missing
FRS Objects and FRS Attributes in Active Directory
......... failed with 2 error(s)
Checking for Replica Set configuration triggers... passed
Checking for suspicious file Backlog size...
ERROR : File Backlog TO server "DOMAIN\SERVER1$" is : 181 :: Unless this
is due to your schedule, this is a problem!
ERROR : File Backlog TO server "DOMAIN\SERVER3$" is : 181 :: Unless this
is due to your schedule, this is a problem!
failed with 2 error(s) and 0 warning(s)
and finally...
Checking for errors in debug logs ...
6032: 904: S0: 17:18:38> :SR: Cmd 00f2d790, CxtG a5163363, WS
ERROR_ACCESS_DENIED, To server1.jasonsconsulting.com Len: (370) [SndFail -
Send Penalty]
6032: 877: S0: 17:18:39> :SR: Cmd 00f2d790, CxtG b0cf9331, WS
ERROR_ACCESS_DENIED, To server1.jasonsconsulting.com Len: (368) [SndFail -
rpc call]
6032: 904: S0: 17:18:39> :SR: Cmd 00f2d790, CxtG b0cf9331, WS
ERROR_ACCESS_DENIED, To server1.jasonsconsulting.com Len: (368) [SndFail -
Send Penalty]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that DNS
returns the IP address of the wrong computer. Check DNS records being
returned, Check if FRS is currently running on the target server. Check if
<SndCsMain: 1992: 883: S0: 17:18:09> ++ ERROR -
EXCEPTION (000006d9) : WStatus: EPT_S_NOT_REGISTERED
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that DNS
returns the IP address of the wrong computer. Check DNS records being
returned, Check if FRS is currently running on the target server. Check if
<SndCsMain: 1992: 884: S0: 17:18:09> :SR: Cmd 00f2d4d8,
CxtG b0cf9331, WS EPT_S_NOT_REGISTERED, To server1.jasonsconsulting.com
Len: (368) [SndFail - rpc exception]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that DNS
returns the IP address of the wrong computer. Check DNS records being
returned, Check if FRS is currently running on the target server. Check if
<SndCsMain: 1992: 904: S0: 17:18:09> :SR: Cmd 00f2d4d8,
CxtG b0cf9331, WS EPT_S_NOT_REGISTERED, To server1.jasonsconsulting.com
Len: (368) [SndFail - Send Penalty]
ERROR on NtFrs_0001.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was
established to target, but there was a failure to send RPC call package.
RPC_S_CALL_FAILED_DNE
ERROR on NtFrs_0001.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was
established to target, but there was a failure to send RPC call package.
884: S0: 20:40:59> :SR: Cmd 00f0bb10, CxtG a5163363, WS
RPC_S_CALL_FAILED_DNE, To server1.jasonsconsulting.com Len: (538) [SndFail
- rpc exception]
ERROR on NtFrs_0001.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was
established to target, but there was a failure to send RPC call package.
904: S0: 20:40:59> :SR: Cmd 00f0bb10, CxtG a5163363, WS
RPC_S_CALL_FAILED_DNE, To server1.jasonsconsulting.com Len: (538) [SndFail
- Send Penalty]
Found 16 ERROR_ACCESS_DENIED error(s)! Latest ones (up to 3) listed above
Found 17 EPT_S_NOT_REGISTERED error(s)! Latest ones (up to 3) listed above
Found 3 RPC_S_CALL_FAILED_DNE error(s)! Latest ones (up to 3) listed above
......... failed with 36 error entries
Laura
2005-10-09 19:27:16 UTC
Permalink
I am having the exact same problem and have trouble shot it in the same way
and have the same access denied errors as your frsdiag is showing. Have you
tried anything else or gotten this to work? My problem has been going on for
months, I recently inherited this network and was testing GPO settings and
discovered I have a huge mess.
Post by Jason
This is happening on all three DCs. I can make user account changes (password
resets, account deletes, etc) and they get replicated to all three DCs just
fine. Only files in the SYSVOL and the NETLOGON shares will not replicate.
Post by Swedboy
You have three DC's... Do you have the same problem with replication on all
of them or is it just one that the replication is failing on?
Post by Jason
The SP1 firewall is disabled on all three servers and they are on the
same
LAN.
Checking for errors/warnings in FRS Event Log ....
NtFrs 10/7/2005 5:19:49 PM Warning 13508 The message '-2147470140' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'SERVER1', 'SERVER2', 'c:\windows\sysvol\domain',
'server1.jasonsconsulting.com'
NtFrs 10/7/2005 5:19:49 PM Warning 13508 The message '-2147470140' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'SERVER3', 'SERVER2', 'c:\windows\sysvol\domain',
'server3.jasonsconsulting.com'
NtFrs 10/7/2005 5:18:09 PM Warning 13562 The message '-2147470086' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'server2.jasonsconsulting.com', ''
NtFrs 10/7/2005 4:01:28 PM Warning 13508 The message '-2147470140' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'SERVER3', 'SERVER2', 'c:\windows\sysvol\domain',
'server3.jasonsconsulting.com'
and...
NtFrs 10/6/2005 11:37:58 AM Error 13526 The message '-1073728298' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'c:\windows\sysvol\domain', 'SERVER1',
'cn=server1,ou=domain controllers,dc=jasonsconsulting,dc=com'
NtFrs 10/6/2005 11:37:58 AM Error 13526 The message '-1073728298' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'c:\windows\sysvol\domain', 'SERVER3',
'cn=server3,ou=domain controllers,dc=jasonsconsulting,dc=com'
NtFrs 10/6/2005 11:37:57 AM Error 13526 The message '-1073728298' for
'C:\WINDOWS\system32\ntfrsres.dll'. The log entry contains the following
replacement strings:'c:\dfs', 'SERVER1', 'cn=server1,ou=domain
controllers,dc=jasonsconsulting,dc=com'
and...
WARNING: Found Event ID 13508 errors without trailing 13509 ... see above
for (up to) the 3 latest entries!
......... failed 26
Checking for errors in Directory Service Event Log ....
NTDS Replication 10/5/2005 9:45:23 AM Error 2042 The message '-1073739782'
'C:\WINDOWS\system32\ntdsmsg.dll'. The log entry contains the following
replacement strings:'2004-09-13 09:39:48',
'02c3f6c8-f6b8-02c3-0100-000000000000',
'a5c882df-4abd-4def-9b1a-c5ab78bb1f90._msdcs.jasonsconsulting.com', '60',
'Allow Replication With Divergent and Corrupt Partner'
and...
Checking for errors/warnings in ntfrsutl ds ...
ERROR : missing Computer Ref for server
"{AA9B2ADC-18CB-4359-AA81-ADB7E625377B}"
Look for frsComputerReference on KB Article : 312862 Recovering Missing
FRS Objects and FRS Attributes in Active Directory
ERROR : missing Computer Ref for server
"{E5B78CBB-2668-405E-BAE2-C676ACCD8A0D}"
Look for frsComputerReference on KB Article : 312862 Recovering Missing
FRS Objects and FRS Attributes in Active Directory
......... failed with 2 error(s)
Checking for Replica Set configuration triggers... passed
Checking for suspicious file Backlog size...
ERROR : File Backlog TO server "DOMAIN\SERVER1$" is : 181 :: Unless this
is due to your schedule, this is a problem!
ERROR : File Backlog TO server "DOMAIN\SERVER3$" is : 181 :: Unless this
is due to your schedule, this is a problem!
failed with 2 error(s) and 0 warning(s)
and finally...
Checking for errors in debug logs ...
6032: 904: S0: 17:18:38> :SR: Cmd 00f2d790, CxtG a5163363, WS
ERROR_ACCESS_DENIED, To server1.jasonsconsulting.com Len: (370) [SndFail -
Send Penalty]
6032: 877: S0: 17:18:39> :SR: Cmd 00f2d790, CxtG b0cf9331, WS
ERROR_ACCESS_DENIED, To server1.jasonsconsulting.com Len: (368) [SndFail -
rpc call]
6032: 904: S0: 17:18:39> :SR: Cmd 00f2d790, CxtG b0cf9331, WS
ERROR_ACCESS_DENIED, To server1.jasonsconsulting.com Len: (368) [SndFail -
Send Penalty]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that DNS
returns the IP address of the wrong computer. Check DNS records being
returned, Check if FRS is currently running on the target server. Check if
<SndCsMain: 1992: 883: S0: 17:18:09> ++ ERROR -
EXCEPTION (000006d9) : WStatus: EPT_S_NOT_REGISTERED
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that DNS
returns the IP address of the wrong computer. Check DNS records being
returned, Check if FRS is currently running on the target server. Check if
<SndCsMain: 1992: 884: S0: 17:18:09> :SR: Cmd 00f2d4d8,
CxtG b0cf9331, WS EPT_S_NOT_REGISTERED, To
server1.jasonsconsulting.com
Len: (368) [SndFail - rpc exception]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that DNS
returns the IP address of the wrong computer. Check DNS records being
returned, Check if FRS is currently running on the target server. Check if
<SndCsMain: 1992: 904: S0: 17:18:09> :SR: Cmd 00f2d4d8,
CxtG b0cf9331, WS EPT_S_NOT_REGISTERED, To
server1.jasonsconsulting.com
Len: (368) [SndFail - Send Penalty]
ERROR on NtFrs_0001.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was
established to target, but there was a failure to send RPC call package.
RPC_S_CALL_FAILED_DNE
ERROR on NtFrs_0001.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was
established to target, but there was a failure to send RPC call package.
884: S0: 20:40:59> :SR: Cmd 00f0bb10, CxtG a5163363, WS
RPC_S_CALL_FAILED_DNE, To server1.jasonsconsulting.com Len: (538) [SndFail
- rpc exception]
ERROR on NtFrs_0001.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was
established to target, but there was a failure to send RPC call package.
904: S0: 20:40:59> :SR: Cmd 00f0bb10, CxtG a5163363, WS
RPC_S_CALL_FAILED_DNE, To server1.jasonsconsulting.com Len: (538) [SndFail
- Send Penalty]
Found 16 ERROR_ACCESS_DENIED error(s)! Latest ones (up to 3) listed above
Found 17 EPT_S_NOT_REGISTERED error(s)! Latest ones (up to 3) listed above
Found 3 RPC_S_CALL_FAILED_DNE error(s)! Latest ones (up to 3) listed above
......... failed with 36 error entries
Paul Williams [MVP]
2005-10-09 21:28:24 UTC
Permalink
This is quite a big thread, so I didn't read it all. My apologies if I've
missed something.

Check the FRS event logs on each DC and look for errors and/ or warnings.
Restart FRS on each DC and check the event logs again. I suspect that you
either have Journal Wraps, Assertion errors, or not fully completed SYSVOL
initialisations. You can probably resolve any of the above by performing a
non-authorative restore of SYSVOL.

To do this, on the machines that aren't replicating SYSVOL, perform the
following steps:

1. Stop FRS (net stop ntfrs)
2. Set the registry value "BurFlags" to "D2" (neither actually have or need
the quotes). This value can be found under:
HKLM\ SYSTEM\ CurrentControlSet\ Services\ NtFrs\ Parameters\
Backup/Restore\ Process at Startup

3. Start FRS (net start ntfrs)


Don't do this on the working replica. Only on the DCs that aren't working.
This will discard the existing SYSVOL and pull a new copy from its upstream
partner.
--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net
Continue reading on narkive:
Loading...