title: Problem with NTFRS - Missing Sysvol and Netlogon on a 2003 Server
body: <p>This is a problem that is affecting me. Although this description wasn´t written by me (seen at www.experts-exchange.com (1), one of the kind of sites stackoverflow was created because of) it applies 95% to the problem I´m having. Next time I won´t follow MS advice, The domain was working until I tried the suggested solution on the event log ("Enable Journal Wrap Automatic Restore"). What a mistake it was!!!.</p>
  
  <p>Description (as seen in (1)) follows:</p>
  
  <p>(1)
  <a href="http://www.experts-exchange.com/OS/Microsoft%5fOperating%5fSystems/Server/Windows%5f2003%5fActive%5fDirectory/Q%5f22871376.html" rel="nofollow noreferrer">http://www.experts-exchange.com/OS/Microsoft%5fOperating%5fSystems/Server/Windows%5f2003%5fActive%5fDirectory/Q%5f22871376.html</a></p>
  
  <p>---------- Cut starts here ---------- </p>
  
  <p>I am having some apparently serious problems with a 2003 SBS server.</p>
  
  <p>We have just started the process of putting in a second Domain Controller into this network for a project.</p>
  
  <p>I performed the same task in a lab environment before I started on the live environment, and had no problems.</p>
  
  <p>Firstly, we upgraded the SBS (tisserver) to 2003 R2. After that, I did the adprep to update the schema to R2.</p>
  
  <p>I built up the 2003 R2 server (tisdr), installed DNS, joined it to the domain and did a DCPROMO.</p>
  
  <p>This all worked fine, but I discovered errors in the File Replicaction Service event log on the new server:</p>
  
  <hr>
  
  <p>Event ID 13508 - Source NtFRS</p>
  
  <hr>
  
  <p>The File Replication Service is having trouble enabling replication from tisserver.TIS.local to TISDR for c:\windows\sysvol\domain using the DNS name tisserver.TIS.local. FRS will keep retrying.
   Following are some of the reasons you would see this warning.</p>
  
  <p>[1] FRS can not correctly resolve the DNS name tisserver.TIS.local from this computer.
   [2] FRS is not running on tisserver.TIS.local.
   [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers.</p>
  
  <p>This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.</p>
  
  <p>For more information, see Help and Support Center at <a href="http://go.microsoft.com/fwlink/events.asp" rel="nofollow noreferrer">http://go.microsoft.com/fwlink/events.asp</a>.</p>
  
  <hr>
  
  <p>When I went and checked the SBS, I found the following error had been occurring:</p>
  
  <hr>
  
  <p>Eventid ID 13568 - Source NtFrs</p>
  
  <hr>
  
  <p>The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR.</p>
  
  <p>Replica set name is    : "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
   Replica root path is   : "c:\windows\sysvol\domain"
   Replica root volume is : "\.\C:"
   A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found.  This can occur because of one of the following reasons.</p>
  
  <p>[1] Volume "\.\C:" has been formatted.
   [2] The NTFS USN journal on volume "\.\C:" has been deleted.
   [3] The NTFS USN journal on volume "\.\C:" has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.
   [4] File Replication Service was not running on this computer for a long time.
   [5] File Replication Service could not keep up with the rate of Disk IO activity on "\.\C:".
   Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.
   [1] At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run "net stop ntfrs" followed by "net start ntfrs" to restart the File Replication Service.
   [2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.</p>
  
  <p>WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.</p>
  
  <p>To change this registry parameter, run regedit.</p>
  
  <p>Click on Start, Run and type regedit.</p>
  
  <p>Expand HKEY_LOCAL_MACHINE.
  Click down the key path:
     "System\CurrentControlSet\Services\NtFrs\Parameters"
  Double click on the value name
     "Enable Journal Wrap Automatic Restore"
  and update the value.</p>
  
  <p>If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above.</p>
  
  <p>For more information, see Help and Support Center at <a href="http://go.microsoft.com/fwlink/events.asp" rel="nofollow noreferrer">http://go.microsoft.com/fwlink/events.asp</a>.</p>
  
  <hr>
  
  <p>After doing a bit of reading, it seemed like the right thing to do was a non-authoritative resotre, so I went through and created the registry key, then stopped and started the NTFRS service.</p>
  
  <p>As expected, I got:</p>
  
  <hr>
  
  <p>EventID 13560 - Source NtFRS</p>
  
  <hr>
  
  <p>The File Replication Service is deleting this computer from the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" as an attempt to recover from the error state,
   Error status = FrsErrorSuccess
   At the next poll, which will occur in 5 minutes, this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.</p>
  
  <p>For more information, see Help and Support Center at <a href="http://go.microsoft.com/fwlink/events.asp" rel="nofollow noreferrer">http://go.microsoft.com/fwlink/events.asp</a>.</p>
  
  <hr>
  
  <p>Exactly five minutes later, I got:</p>
  
  <hr>
  
  <p>EventID 13520 - Source NtFRS</p>
  
  <hr>
  
  <p>The File Replication Service moved the preexisting files in c:\windows\sysvol\domain to c:\windows\sysvol\domain\NtFrs_PreExisting___See_EventLog.</p>
  
  <p>The File Replication Service may delete the files in c:\windows\sysvol\domain\NtFrs_PreExisting___See_EventLog at any time. Files can be saved from deletion by copying them out of c:\windows\sysvol\domain\NtFrs_PreExisting___See_EventLog. Copying the files into c:\windows\sysvol\domain may lead to name conflicts if the files already exist on some other replicating partner.</p>
  
  <p>In some cases, the File Replication Service may copy a file from c:\windows\sysvol\domain\NtFrs_PreExisting___See_EventLog into c:\windows\sysvol\domain instead of replicating the file from some other replicating partner.</p>
  
  <p>Space can be recovered at any time by deleting the files in c:\windows\sysvol\domain\NtFrs_PreExisting___See_EventLog.</p>
  
  <p>For more information, see Help and Support Center at</p>
  
  <hr>
  
  <p>&amp;</p>
  
  <hr>
  
  <p>EventID 13553 - Source NtFRS</p>
  
  <hr>
  
  <p>The File Replication Service successfully added this computer to the following replica set:
      "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"</p>
  
  <p>Information related to this event is shown below:
  Computer DNS name is "tisserver.TIS.local"
  Replica set member name is "TISSERVER"
  Replica set root path is "c:\windows\sysvol\domain"
  Replica staging directory path is "c:\windows\sysvol\staging\domain"
  Replica working directory path is "c:\windows\ntfrs\jet"</p>
  
  <p>For more information, see Help and Support Center at</p>
  
  <hr>
  
  <p>---------- Cut ends here ---------- </p>
  
  <p>From this point on the responses I got start to drift from the original poster:</p>
  
  <hr>
  
  <p>EventID 13566 - Source NtFRS</p>
  
  <hr>
  
  <p>File Replication Service is scanning the data in the system volume. Computer DOMSERVER cannot become a domain controller until this process is complete. The system volume will then be shared as SYSVOL. </p>
  
  <p>To check for the SYSVOL share, at the command prompt, type: 
  net share </p>
  
  <p>When File Replication Service completes the scanning process, the SYSVOL share will appear. </p>
  
  <p>The initialization of the system volume can take some time. The time is dependent on the amount of data in the system volume.</p>
  
  <p>For more information, see Help and Support Center at <a href="http://go.microsoft.com/fwlink/events.asp" rel="nofollow noreferrer">http://go.microsoft.com/fwlink/events.asp</a>.</p>
  
  <hr>
  
  <p>I have left it for about an hour and a half now, and am not seeing any sign of a sysvol or netlogon share yet. The users are unable to log on. I don´t know where to go to from here. I´m in such desperate state that, if I had the money, I sure would pay experts-exchange (and the bad guys would win, I know :( ). Unfortunaly, I can´t do that for many reasons (not having a credit card is one of them).</p>
  
  <p>Your help would be greatly appreciated!</p>
  
  <p>PS: sorry for my not so good english. It´s not my mother tongue. Next time I will be better at it. :)</p>