Home | Site Map | Cisco How ToNet How To | Wireless |Search | Forums | Services | Donations | Careers | About Us | Contact Us|

Event ID 13559: replica root path has changed

Active Directory, Domain, DNS, WINS, DHCP, SBS, New Releases.

Event ID 13559: replica root path has changed

Postby chicagotech » Sun Apr 01, 2012 2:29 pm

Situation: You may receive event id 13559 on one of your DCDC and it doesn't replicate to the other DC.

Resolution:

Please verify that all File replication services on ALL Domain Controllers are stopped Before this process: open CMD (Run as Administrator) and type: net stop ntfrs for each DC:

To fix the above issue do the following:

1. Click Start, and then click Run.
2. In the Open box, type cmd and then press ENTER.
3. In the Command box, type net stop ntfrs (as mentioned above)
4. Click Start, and then click Run.
5. In the Open box, type regedit and then press ENTER.
6. Locate the following subkey in the registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup
7. In the right pane, double click BurFlags.
8. In the Edit DWORD Value dialog box, type D4 and then click OK.
Quit Registry Editor, and then switch to the Command box.
9. In the Command box, type net start ntfrs
10. Quit the Command box.

This should fix the replica issue. If you have other DCs you should start the file replication service:

net start ntfrs

Also you may use Nonauthoritative restore for the other DCs.
Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
chicagotech
Site Admin
 
Posts: 6484
Joined: Mon Nov 27, 2006 1:24 pm
Location: Chicago USA

Re: Event ID 13559: replica root path has changed

Postby chicagotech » Sun Apr 01, 2012 2:31 pm

On a Windows 2000/2003 domain having multiple domain controllers, if one of them displays this event, you may have workstations logging on to the domain and not receiving/applying the appropriate GPOs. As M887440 says, create a blank file named NTFRS_CMD_FILE_MOVE_ROOT in C:\winnt\sysvol\domain, and run "net stop ntfrs" and then "net start ntfrs". Allow some time (more than 10 minutes) for the system to replicate the GPOs from the primary DC. If you browse to the c:\winnt\sysvol\domain folder, you will see them being copied. The old files will be automatically copied to a subfolder called "NtFrs_PreExisting___See_EventLog". You should delete this folder ASAP after verifying that the NTFRS is working perfectly, because if this problem happens again, you will experience file name errors. See also EventID 13520 from source NtFrs.
Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
chicagotech
Site Admin
 
Posts: 6484
Joined: Mon Nov 27, 2006 1:24 pm
Location: Chicago USA

Re: Event ID 13559: replica root path has changed

Postby guest » Fri Apr 06, 2012 11:16 pm

The first DC complained about the variation of c:\sysvol\domain path. The solution is provided in the error log itself (event id 13599), and i'm summarizing the solution here:

Create a simple empty txt file in c:\sysvol\domain folder (change the path according to your ad configuration, in case you changed it from default).
Rename the file to NTFRS_CMD_FILE_MOVE_ROOT without any extension, just like i wrote it.

After this, restart ntfrs:
net stop ntfrs
net start ntfrs

After a while, the original DC will tell you it successfully restored ntfrs functions.

Restart ntfrs with the above commands on your new DC as well, and check its logs: the replication will occur succesfully
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 9522
Joined: Mon Nov 27, 2006 1:10 pm

Re: Event ID 13559: replica root path has changed

Postby guest » Fri Apr 06, 2012 11:17 pm

In my case these changes didn't resolve the problem:
1. Stop FRS.
2. Start Registry Editor (Regedt32.exe).
3. Locate and click the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters
4. On the Edit menu, click Add Value, and then add the following registry value:
Value name: Enable Journal Wrap Automatic Restore
Data type: REG_DWORD
Radix: Hexadecimal
Value data: 1 (Default 0)
5. Quit Registry Editor.
6. Restart FRS.

So i did these too:

1. Stop FRS.
2. Start Registry Editor (Regedt32.exe).
3. Locate and click the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore/Process at Startup
4. On the Edit menu, click Add Value, and then add the following registry value:
Value name: BurFlags
Data type: REG_DWORD
Radix: Hexadecimal
Value data: D2
5. Quit Registry Editor.
6. Restart FRS.
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 9522
Joined: Mon Nov 27, 2006 1:10 pm

Re: Event ID 13559: replica root path has changed

Postby guest » Fri Apr 06, 2012 11:20 pm

In our case, the problem was solved after setting the "nonauthoritative mode restore (D2)" value on the failing domain controller, and the "authoritative mode restore (D4)" value on the working domain controller. It appeared that these domain controllers have never finished initial replication between them since the first one was promoted
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 9522
Joined: Mon Nov 27, 2006 1:10 pm

Re: Event ID 13559: replica root path has changed

Postby guest » Fri Apr 06, 2012 11:23 pm

File Replication Service Diagnostics Tool (FRSDiag.exe) might help you to solve this problem. As per Microsoft: "FRSDiag provides a graphical interface to help troubleshoot and diagnose problems with the File Replication Service (FRS). FRSDiag helps to gather snap-shot information about the service, perform automated tests against that data, and compile an overview of possible problems that may exist in the environment". See the link bellow to download the tool.

From a newsgroup post: "Event 13508 in the FRS log is a warning that the FRS service has been unable to complete the RPC connection to a specific replication partner. It indicates that FRS is having trouble, enabling replication with that partner and will keep trying to establish the connection. A single event ID 13508 does not mean anything is broken or not working; simply look for event ID 13509 to make sure that the problem was resolved. Based on the time between event IDs 13508 and 13509, you can determine if there is a real problem that needs to be addressed.
Note that if FRS is stopped after a 13508 event, and then later started at a time when the communication issue has been resolved, no 13509 will be entered in the event log, and without a 13508 message reappearing, replication connections are being made correctly.
Since FRS servers gather their replication topology information from their closest Active Directory domain controller (itself on a domain controller that is also an FRS member), there is also an expected case where a replica partner in another site will not be aware of the replica set until the topology information has been replicated to domain controllers in that site. When the topology information finally reaches that distant domain controller, the FRS partner in that site will be able to participate in the replica set and lead to FRS event ID 13509. Note that intra-site Active Directory replication partners replicate every 5 minutes. Inter-site replication only replicates when the schedule is open (shortest delay is 15 minutes). In addition, FRS polls the topology in the active directory at defined intervals – 5 minutes on domain controllers, and 1 hour on other member servers of a replica set. These delays and schedules (and especially in topologies with multiple hops) can delay propagation of the FRS replication topology
Procedures for Troubleshooting FRS Event 13508 without Event 13509:
1. Examine the 13508 Event in the FRS Event Log in order to determine which machine that FRS has been unable to communicate with.
2. Determine whether the remote machine is working properly, and verify that FRS is running on it. A good method to do this to execute “NTFRSUTL VERSION <FQDN of remote DC name>” from the machine logging the 13508 event. If this fails, check network connectivity by pinging the <FQDN of remote DC name> from the machine logging the 13508 event. If this fails, then troubleshoot as a DNS or TCP/IP issue. If it succeeds, confirm the FRS service is started on the remote DC.
3. Determine whether FRS has ever been able to communicate with the remote computer by looking for 13509 in the event log and review recent change management to networking, firewalls, DNS configuration, and Active Directory infrastructure to see if there is a correlation.
4. Determine whether there is anything between the two machines that is capable of blocking RPC traffic, such as a firewall or router.
5. Confirm that Active Directory replication is working".

See the links to "Troubleshooting File Replication Service", "Monitoring and Troubleshooting the File Replication Service", "FRS Technical Reference", and "EventID 13508 from source FRS" for more details on fixing this problem
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 9522
Joined: Mon Nov 27, 2006 1:10 pm

Re: Event ID 13559: replica root path has changed

Postby guest » Fri Apr 06, 2012 11:29 pm

The "Secure Channel" password between the DCs has been broken. I had three domain controllers and the PDC got it's time changed by months. This created pandemonium because the other servers on the network started changing their times and other people on the network could not log in because of the time difference. Here is what you do to fix it:
1. Stop the Key Distribution service on the BDC.
2. Set it to disabled.
3. Open a command prompt and type: "netdom resetpwd /server:<BDC Name> /user:<domain name> \administrator /password:<*****>”.
4. Restart the server
5. A new ticket will be assigned to the server from the PDC emulator. The KDS Service must still be disabled.
6. Set the KDS Service to Auto and start it.
Do this to all of the DCs except the PDC Emulator
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 9522
Joined: Mon Nov 27, 2006 1:10 pm

Re: Event ID 13559: replica root path has changed

Postby guest » Fri Apr 06, 2012 11:30 pm

We have two DCs in one domain. DC1 showed event ID 13508 and DC2 showed event ID 1265. These problems were caused by missing DNS SRV records on DC1 (DNS server). You could add them manually, but I solved the problem by running “netdiag /fix” on DC2. Running netdiag added the missing records to the DNS automatically.
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 9522
Joined: Mon Nov 27, 2006 1:10 pm

Re: Event ID 13559: replica root path has changed

Postby guest » Fri Apr 06, 2012 11:33 pm

The permission for the folder that was being replicated was removed. Make sure SYSTEM has full permission on the folder. I had to check each DC for the folder location and set SYSTEM permission to full.
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 9522
Joined: Mon Nov 27, 2006 1:10 pm

Re: Event ID 13559: replica root path has changed

Postby guest » Fri Apr 06, 2012 11:34 pm

The following workaround worked for me. Make the following changes in the registry to instruct FRS to handle the JRNL_WRAP_ERROR status automatically:
1. Stop FRS.
2. Start Registry Editor (Regedt32.exe).
3. Locate and click the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters
4. On the Edit menu, click Add Value, and then add the following registry value:
Value name: Enable Journal Wrap Automatic Restore
Data type: REG_DWORD
Radix: Hexadecimal
Value data: 1 (Default 0)
5. Quit Registry Editor.
6. Restart FRS.
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 9522
Joined: Mon Nov 27, 2006 1:10 pm

Re: Event ID 13559: replica root path has changed

Postby guest » Fri Apr 06, 2012 11:35 pm

Changing from a mixed mode domain to a native mode may fix this problem on SP2 machines
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 9522
Joined: Mon Nov 27, 2006 1:10 pm

Re: Event ID 13559: replica root path has changed

Postby guest » Fri Apr 06, 2012 11:39 pm

To resolve this problem I synchronized the computer's clock with the domain controller that is the authoritative time server. For each server that was experiencing this difficulty, I opened a CMD prompt and typed:
net time \\ComputerName_Of_Authoritative_Time_Server /set /y
net stop ntfrs
net start ntfrs
I started and stopped Ntfrs and got the following: The FRS is no longer preventing the computer DC02 from becoming a domain controller. The system volume has been successfully initialized and the Netlogon service has been notified that the system volume is now ready to be shared as SYSVOL.
Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com

Troubleshooting Vista Wireless
http://chicagotech.net/
guest
 
Posts: 9522
Joined: Mon Nov 27, 2006 1:10 pm

Re: Event ID 13559: replica root path has changed

Postby blin » Sat Apr 13, 2013 8:13 pm

This is to confirm these steps fix the problem.
1. Stop FRS on all DCs.
2. Start Registry Editor (Regedt32.exe).
3. Locate and click the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore/Process at Startup
4. On the Edit menu, click Add Value, and then add the following registry value:
Value name: BurFlags
Data type: REG_DWORD
Radix: Hexadecimal
Value data: D2 ("nonauthoritative mode restore (D2)" value on the failing domain controller)
Value data: D4 (the "authoritative mode restore (D4)" value on the working domain controller).
5. Quit Registry Editor.
6. Restart FRS on all DCs.
How to Configure and Troubleshoot Cisco
http://www.howtocisco.com

Tablet and Smartphone Setup Guide
http://www.quicksetupguide.com
blin
Site Admin
 
Posts: 2655
Joined: Wed Dec 31, 1969 7:00 pm
Location: Chicago, USA


Return to Windows

Your Ad Here

Who is online

Users browsing this forum: No registered users and 8 guests