//flex table opened by JP

Click to See Complete Forum and Search --> : 2000 Server Domain Controllers Strange error. event id 13559 .


ronsandiego
03-18-2003, 03:46 PM
Hello all,
I am having a strange error message on my 2 Win 2000 Server Domain controllers lately.

Background= 2 Win2000 Server Domain Controllers (both have DNS and WINS installed), 1 member Win2000 server (does DHCP and RRAS), and 25 client PCs on Win2000 Pro. Native mode. I have all HDs in removable drives, with docking bays. I do Domain Controller backups using Drive Image on a separate PC, and clone each DC Hard Drive every 2 weeks or so.

About 1 week ago, the existing Domain Controllers developed some errors I did not want to deal with, so I went back to the 2 clones for the Domain Controllers, which were about 3 weeks old at the time. Since then, the other errors are not present, but a new one has developed that I can find basically no information about. And it is persisting.

This error is found on each DC in the FRS event logs, and is occuring at exactly 24 hour intervals on each DC. There are a pair of these messages 45 minutes apart, with 24 hours between each pair of error events.
The event Id is event id 13559

In the FRS event log.

Here is the text I get.

3/14/03 at 13:18

Begin quote---
The File Replication Service has detected that the replica root
path has changed from "c:\winnt\sysvol\domain" to "c:\winnt\sysvol\domain".
If this is an intentional move then a file with the name NTFRS_CMD_FILE_MOVE_ROOT
needs to be created under the new root path.
This was detected for the following replica set:
"DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"

Changing the replica root path is a two step process
which is triggered by the creation of the NTFRS_CMD_FILE_MOVE_ROOT file.

[1] At the first poll which will occur in 5 minutes this computer
will be deleted from the replica set.
[2] At the poll following the deletion this computer will be re-added
to the replica set with the new root path. This re-addition will trigger
a full tree sync for the replica set. At the end of the sync all the files
will be at the new location. The files may or may not be deleted from the old location depending on whether they are needed or not.
End Quote.....

Then, this same error message occurs about 45 minutes later.
In the example case here, the next msg was at 14:03 on the same date. The text and the event number are exactly the same.

Then, 24 hours later, the same pair of event id messages occurs again. One, followed at 45 minutes later by the same message.

These same patterns occur on each Domain Controller. The times are offset by about 4 hours, but are at regular 24 hour intervals for each pair of events.

This has been going on for 5 days now. The system is not curing itself.

I do not know what type of file needs to be created....???
"then a file with the name NTFRS_CMD_FILE_MOVE_ROOT
needs to be created under the new root path"

And what sense does this make?: "The File Replication Service has detected that the replica root
path has changed from "c:\winnt\sysvol\domain" to "c:\winnt\sysvol\domain".

I will appreciate all help I can get on this.

[Nothing seems amiss with the client PCs or any network interactions. ]

Thanks to everyone in advance.

Ron

omendata
03-18-2003, 06:36 PM
When you restored - did you do an authoratative restore of the AD to resync both machines?

Cant be sure - just off the top of my head but sounds like something is out of sync - SYSVOL gives a clue - its where all replication is stored for AD if I remember right - perhaps because the backups / images were done at different times.

Interesting problem - will have a dig!

omendata
03-18-2003, 06:44 PM
http://support.microsoft.com/default.aspx?scid=kb;EN-US;307319

http://support.microsoft.com/default.aspx?scid=kb;en-us;250978