Mundy

IT Knowledge Base

User Tools

Site Tools


Sidebar

Contact me at dan@mundy.co for any feedback or suggestions.


My other sites:

Search all my sites:

journal_wrap_condition_in_active_directory

Journal Wrap Condition in Active Directory

Event ID 13508, 13568, and anything else related to SYSVOL, JRNL_WRAPS, or NTFRS?

Always take a backup of the SYSVOL before you do anything!

Authoritative Restore process:

  1. Stop the FRS service on all DCs
  2. On a good DC that you want to be the source, run regedit and go to the following key:
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup
  3. In the right pane, double-click “BurFlags.” (or Rt-click, Edit DWORD)
  4. Type D4 and then click OK.
  5. On the bad DC, run regedit and go to the following key:
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup
  6. In the right pane, double-click “BurFlags.” (or Rt-click, Edit DWORD)
  7. Type D2 and then click OK.
  8. On the good DC, start the FRS service
  9. On the bad DC, start the FRS service
  10. On the bad DC, check the Sysvol folder to see if it started populating.
  11. Check for EventID 13565 which shows the process started
  12. Check for EventID 13516, which shows it’s complete
  13. Start FRS on the other DCs.

Which flag?

You have two choices as to a restore from a good DC using FRS:

  • D2 is set on the bad DC: Non-Authoritative restore: Use the D2 option on the DC with the empty SYSVOL folder, or the SYSVOL folder with the incorrect data. This way it will get a copy of the current SYSVOL and other folders from the good DC that you set the BurFlags D4 option on.
  • D4 is set on the good DC: Authoritative restore: Use the BurFlags D4 option on the DC that has a copy of the current policies and scripts folder (a good, not corrupted folder).
journal_wrap_condition_in_active_directory.txt · Last modified: 2018/04/09 09:56 (external edit)