DC Event warning 13508

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Greetings-

I have a rather simple, single domain with two DC's running fully
patched Windows 2000 Server and 3 other member servers, 2 of which are
running fully patched Windows 2000 Server and the other fully patched
Windows 2003 server (my exchange 2003 host).

One DC, shown as DC1 below in the event log text, has exactly one 13508
warning per day in the event log.

I've never seen a corresponding 13509 or 1265 event on either DC.

I've run the full series of tests using DcDiag and NetDiag and no
errors are reported in the resulting logs.

The SRV records appear to be correctly set on both DC's DNS.

The permissions on the Sysvol share are set correctly.

Time syncing is from DC1 and is functioning properly.

This one has me a bit baffled as I do not know what is causing the
event nor do I know if it is critical problem that needs to be
addressed or if it is something that is more of an annoyance event
warning than anything else.


Any thoughts, suggestions, troubleshooting ideas appreciated.
Thx
Gordon Pegue


Event Type: Warning
Event Source: NtFrs
Event Category: None
Event ID: 13508
Date: 1/8/2005
Time: 5:57:25 AM
User: N/A
Computer: DC1
Description:
The File Replication Service is having trouble enabling replication
from DC2 to DC1 for c:\winnt\sysvol\domain using the DNS name
DC2.cg-engrs.cg-engrs.com.

FRS will keep retrying.

Following are some of the reasons you would see this warning.

[1] FRS can not correctly resolve the DNS name
DC2.cg-engrs.cg-engrs.com from this computer.
[2] FRS is not running on DC2.cg-engrs.cg-engrs.com.
[3] The topology information in the Active Directory for this replica
has not yet replicated to all the Domain Controllers.

This event log message will appear once per connection.
After the problem is fixed you will see another event log message
indicating that the connection has been established.
6 answers Last reply
More about event warning 13508
  1. Archived from groups: microsoft.public.win2000.active_directory (More info?)

    http://www.microsoft.com/technet/support/ee/result.aspx?EvtSrc=FRS&EvtID=13508&ProdName=Windows+Operating+System&LCID=1033&ProdVer=5.2

    Have you tried to use the FRSDiag to troubleshoot?

    File Replication Service Diagnostics Tool (FRSDiag.exe)
    http://www.microsoft.com/downloads/details.aspx?FamilyId=43CB658E-8553-4DE7-811A-562563EB5EBF&displaylang=en

    Monitoring and Troubleshooting the File Replication Service
    http://www.microsoft.com/windowsserver2003/technologies/fileandprint/file/dfs/tshootfrs.mspx

    Troubleshooting File Replication Service
    http://www.microsoft.com/technet/prodtechnol/windows2000serv/technologies/activedirectory/maintain/opsguide/part1/adogd11.mspx#EMAA

    br,
    Denis

    "Gordon" wrote:

    > Greetings-
    >
    > I have a rather simple, single domain with two DC's running fully
    > patched Windows 2000 Server and 3 other member servers, 2 of which are
    > running fully patched Windows 2000 Server and the other fully patched
    > Windows 2003 server (my exchange 2003 host).
    >
    > One DC, shown as DC1 below in the event log text, has exactly one 13508
    > warning per day in the event log.
    >
    > I've never seen a corresponding 13509 or 1265 event on either DC.
    >
    > I've run the full series of tests using DcDiag and NetDiag and no
    > errors are reported in the resulting logs.
    >
    > The SRV records appear to be correctly set on both DC's DNS.
    >
    > The permissions on the Sysvol share are set correctly.
    >
    > Time syncing is from DC1 and is functioning properly.
    >
    > This one has me a bit baffled as I do not know what is causing the
    > event nor do I know if it is critical problem that needs to be
    > addressed or if it is something that is more of an annoyance event
    > warning than anything else.
    >
    >
    > Any thoughts, suggestions, troubleshooting ideas appreciated.
    > Thx
    > Gordon Pegue
    >
    >
    >
    >
    > Event Type: Warning
    > Event Source: NtFrs
    > Event Category: None
    > Event ID: 13508
    > Date: 1/8/2005
    > Time: 5:57:25 AM
    > User: N/A
    > Computer: DC1
    > Description:
    > The File Replication Service is having trouble enabling replication
    > from DC2 to DC1 for c:\winnt\sysvol\domain using the DNS name
    > DC2.cg-engrs.cg-engrs.com.
    >
    > FRS will keep retrying.
    >
    > Following are some of the reasons you would see this warning.
    >
    > [1] FRS can not correctly resolve the DNS name
    > DC2.cg-engrs.cg-engrs.com from this computer.
    > [2] FRS is not running on DC2.cg-engrs.cg-engrs.com.
    > [3] The topology information in the Active Directory for this replica
    > has not yet replicated to all the Domain Controllers.
    >
    > This event log message will appear once per connection.
    > After the problem is fixed you will see another event log message
    > indicating that the connection has been established.
    >
    >
  2. Archived from groups: microsoft.public.win2000.active_directory (More info?)

    Finally, yes. Pretty good tool but I'm mystified by the results.
    I ran all tests and they reported as passed EXCEPT for the FRSDiag.txt
    report, included here:

    ------------------------------------------------------------
    FRSDiag v1.7 on 1/17/2005 3:56:20 PM
    ..\Logs\MORRISON on 2005-01-17 at 3.56.20 PM
    ------------------------------------------------------------

    Checking for minimum FRS version requirement ... passed
    Checking for errors/warnings in ntfrsutl ds ... passed
    Checking for Replica Set configuration triggers... passed
    Checking for suspicious file Backlog size... passed
    Checking Overall Disk Space and SYSVOL structure (note: integrity is
    not checked)... passed
    Checking for suspicious inlog entries ... passed
    Checking for suspicious outlog entries ... passed
    Checking for appropriate staging area size ... passed
    Checking for errors in debug logs ...
    ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
    2028: 895: S0: 15:47:07> :SR: Cmd 014c4c90, CxtG 74e60f44, WS
    ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail -
    Send Penalty]
    ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
    2028: 868: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
    ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail -
    rpc call]
    ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
    2028: 895: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
    ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail -
    Send Penalty]
    ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that
    DNS returns the IP address of the wrong computer. Check DNS records
    being returned, Check if FRS is currently running on the target server.
    Check if Ntfrs is registered with the End-Point-Mapper on target
    server!)" : <SndCsMain: 1684: 874: S0: 17:59:47>
    ++ ERROR - EXCEPTION (000006d9) : WStatus: EPT_S_NOT_REGISTERED
    ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that
    DNS returns the IP address of the wrong computer. Check DNS records
    being returned, Check if FRS is currently running on the target server.
    Check if Ntfrs is registered with the End-Point-Mapper on target
    server!)" : <SndCsMain: 1684: 875: S0: 17:59:47>
    :SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
    HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - rpc exception]
    ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that
    DNS returns the IP address of the wrong computer. Check DNS records
    being returned, Check if FRS is currently running on the target server.
    Check if Ntfrs is registered with the End-Point-Mapper on target
    server!)" : <SndCsMain: 1684: 895: S0: 17:59:47>
    :SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
    HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - Send Penalty]

    Found 24404 ERROR_RETRY error(s)! Latest ones (up to 3) listed above
    Found 3 EPT_S_NOT_REGISTERED error(s)! Latest ones (up to 3) listed
    above

    .......... failed with 24407 error entries
    Checking NtFrs Service (and dependent services) state...passed
    Checking NtFrs related Registry Keys for possible problems...passed
    Checking Repadmin Showreps for errors...passed


    So I attempted to find out more about the RPC End Point Mapper and came
    up empty.

    Any more ideas on how to run this down?

    Thanks
    Gordon

    Denis Wong @ Hong Kong wrote:
    >
    > Have you tried to use the FRSDiag to troubleshoot?
    >
    >
    > br,
    > Denis
    >
    > "Gordon" wrote:
    >
    > > Greetings-
    > >
    > > I have a rather simple, single domain with two DC's running fully
    > > patched Windows 2000 Server and 3 other member servers, 2 of which
    are
    > > running fully patched Windows 2000 Server and the other fully
    patched
    > > Windows 2003 server (my exchange 2003 host).
    > >
    > > One DC, shown as DC1 below in the event log text, has exactly one
    13508
    > > warning per day in the event log.
    > >
    > > I've never seen a corresponding 13509 or 1265 event on either DC.
    > >
    > > I've run the full series of tests using DcDiag and NetDiag and no
    > > errors are reported in the resulting logs.
    > >
    > > The SRV records appear to be correctly set on both DC's DNS.
    > >
    > > The permissions on the Sysvol share are set correctly.
    > >
    > > Time syncing is from DC1 and is functioning properly.
    > >
    > > This one has me a bit baffled as I do not know what is causing the
    > > event nor do I know if it is critical problem that needs to be
    > > addressed or if it is something that is more of an annoyance event
    > > warning than anything else.
    > >
    > >
    > > Any thoughts, suggestions, troubleshooting ideas appreciated.
    > > Thx
    > > Gordon Pegue
    > >
    > >
    > >
    > >
    > > Event Type: Warning
    > > Event Source: NtFrs
    > > Event Category: None
    > > Event ID: 13508
    > > Date: 1/8/2005
    > > Time: 5:57:25 AM
    > > User: N/A
    > > Computer: DC1
    > > Description:
    > > The File Replication Service is having trouble enabling replication
    > > from DC2 to DC1 for c:\winnt\sysvol\domain using the DNS name
    > > DC2.cg-engrs.cg-engrs.com.
    > >
    > > FRS will keep retrying.
    > >
    > > Following are some of the reasons you would see this warning.
    > >
    > > [1] FRS can not correctly resolve the DNS name
    > > DC2.cg-engrs.cg-engrs.com from this computer.
    > > [2] FRS is not running on DC2.cg-engrs.cg-engrs.com.
    > > [3] The topology information in the Active Directory for this
    replica
    > > has not yet replicated to all the Domain Controllers.
    > >
    > > This event log message will appear once per connection.
    > > After the problem is fixed you will see another event log message
    > > indicating that the connection has been established.
    > >
    > >
  3. Archived from groups: microsoft.public.win2000.active_directory (More info?)

    Anyone else have any ideas on this?

    Gordon

    Gordon Pegue wrote:
    > Finally, yes. Pretty good tool but I'm mystified by the results.
    > I ran all tests and they reported as passed EXCEPT for the
    FRSDiag.txt
    > report, included here:
    >
    > ------------------------------------------------------------
    > FRSDiag v1.7 on 1/17/2005 3:56:20 PM
    > .\Logs\MORRISON on 2005-01-17 at 3.56.20 PM
    > ------------------------------------------------------------
    >
    > Checking for minimum FRS version requirement ... passed
    > Checking for errors/warnings in ntfrsutl ds ... passed
    > Checking for Replica Set configuration triggers... passed
    > Checking for suspicious file Backlog size... passed
    > Checking Overall Disk Space and SYSVOL structure (note: integrity is
    > not checked)... passed
    > Checking for suspicious inlog entries ... passed
    > Checking for suspicious outlog entries ... passed
    > Checking for appropriate staging area size ... passed
    > Checking for errors in debug logs ...
    > ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
    > 2028: 895: S0: 15:47:07> :SR: Cmd 014c4c90, CxtG 74e60f44, WS
    > ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail
    -
    > Send Penalty]
    > ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
    > 2028: 868: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
    > ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail
    -
    > rpc call]
    > ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
    > 2028: 895: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
    > ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail
    -
    > Send Penalty]
    > ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate
    that
    > DNS returns the IP address of the wrong computer. Check DNS records
    > being returned, Check if FRS is currently running on the target
    server.
    > Check if Ntfrs is registered with the End-Point-Mapper on target
    > server!)" : <SndCsMain: 1684: 874: S0:
    17:59:47>
    > ++ ERROR - EXCEPTION (000006d9) : WStatus: EPT_S_NOT_REGISTERED
    > ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate
    that
    > DNS returns the IP address of the wrong computer. Check DNS records
    > being returned, Check if FRS is currently running on the target
    server.
    > Check if Ntfrs is registered with the End-Point-Mapper on target
    > server!)" : <SndCsMain: 1684: 875: S0:
    17:59:47>
    > :SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
    > HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - rpc exception]
    > ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate
    that
    > DNS returns the IP address of the wrong computer. Check DNS records
    > being returned, Check if FRS is currently running on the target
    server.
    > Check if Ntfrs is registered with the End-Point-Mapper on target
    > server!)" : <SndCsMain: 1684: 895: S0:
    17:59:47>
    > :SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
    > HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - Send Penalty]
    >
    > Found 24404 ERROR_RETRY error(s)! Latest ones (up to 3) listed above
    > Found 3 EPT_S_NOT_REGISTERED error(s)! Latest ones (up to 3) listed
    > above
    >
    > ......... failed with 24407 error entries
    > Checking NtFrs Service (and dependent services) state...passed
    > Checking NtFrs related Registry Keys for possible problems...passed
    > Checking Repadmin Showreps for errors...passed
    >
    >
    > So I attempted to find out more about the RPC End Point Mapper and
    came
    > up empty.
    >
    > Any more ideas on how to run this down?
    >
    > Thanks
    > Gordon
    >
    > Denis Wong @ Hong Kong wrote:
    > >
    > > Have you tried to use the FRSDiag to troubleshoot?
    > >
    > >
    > > br,
    > > Denis
    > >
    > > "Gordon" wrote:
    > >
    > > > Greetings-
    > > >
    > > > I have a rather simple, single domain with two DC's running fully
    > > > patched Windows 2000 Server and 3 other member servers, 2 of
    which
    > are
    > > > running fully patched Windows 2000 Server and the other fully
    > patched
    > > > Windows 2003 server (my exchange 2003 host).
    > > >
    > > > One DC, shown as DC1 below in the event log text, has exactly one
    > 13508
    > > > warning per day in the event log.
    > > >
    > > > I've never seen a corresponding 13509 or 1265 event on either DC.
    > > >
    > > > I've run the full series of tests using DcDiag and NetDiag and no
    > > > errors are reported in the resulting logs.
    > > >
    > > > The SRV records appear to be correctly set on both DC's DNS.
    > > >
    > > > The permissions on the Sysvol share are set correctly.
    > > >
    > > > Time syncing is from DC1 and is functioning properly.
    > > >
    > > > This one has me a bit baffled as I do not know what is causing
    the
    > > > event nor do I know if it is critical problem that needs to be
    > > > addressed or if it is something that is more of an annoyance
    event
    > > > warning than anything else.
    > > >
    > > >
    > > > Any thoughts, suggestions, troubleshooting ideas appreciated.
    > > > Thx
    > > > Gordon Pegue
    > > >
    > > >
    > > >
    > > >
    > > > Event Type: Warning
    > > > Event Source: NtFrs
    > > > Event Category: None
    > > > Event ID: 13508
    > > > Date: 1/8/2005
    > > > Time: 5:57:25 AM
    > > > User: N/A
    > > > Computer: DC1
    > > > Description:
    > > > The File Replication Service is having trouble enabling
    replication
    > > > from DC2 to DC1 for c:\winnt\sysvol\domain using the DNS name
    > > > DC2.cg-engrs.cg-engrs.com.
    > > >
    > > > FRS will keep retrying.
    > > >
    > > > Following are some of the reasons you would see this warning.
    > > >
    > > > [1] FRS can not correctly resolve the DNS name
    > > > DC2.cg-engrs.cg-engrs.com from this computer.
    > > > [2] FRS is not running on DC2.cg-engrs.cg-engrs.com.
    > > > [3] The topology information in the Active Directory for this
    > replica
    > > > has not yet replicated to all the Domain Controllers.
    > > >
    > > > This event log message will appear once per connection.
    > > > After the problem is fixed you will see another event log message
    > > > indicating that the connection has been established.
    > > >
    > > >
  4. Archived from groups: microsoft.public.win2000.active_directory (More info?)

    If you haven't already, have a look at this:
    --
    http://www.eventid.net/display.asp?eventid=13508&eventno=349&source=NtFrs&phase=1


    --

    Paul Williams

    http://www.msresource.net
    http://forums.msresource.net


    "Gordon Pegue" <gpegue@cg-engrs.com> wrote in message
    news:1106182568.389558.88010@c13g2000cwb.googlegroups.com...
    Anyone else have any ideas on this?

    Gordon

    Gordon Pegue wrote:
    > Finally, yes. Pretty good tool but I'm mystified by the results.
    > I ran all tests and they reported as passed EXCEPT for the
    FRSDiag.txt
    > report, included here:
    >
    > ------------------------------------------------------------
    > FRSDiag v1.7 on 1/17/2005 3:56:20 PM
    > .\Logs\MORRISON on 2005-01-17 at 3.56.20 PM
    > ------------------------------------------------------------
    >
    > Checking for minimum FRS version requirement ... passed
    > Checking for errors/warnings in ntfrsutl ds ... passed
    > Checking for Replica Set configuration triggers... passed
    > Checking for suspicious file Backlog size... passed
    > Checking Overall Disk Space and SYSVOL structure (note: integrity is
    > not checked)... passed
    > Checking for suspicious inlog entries ... passed
    > Checking for suspicious outlog entries ... passed
    > Checking for appropriate staging area size ... passed
    > Checking for errors in debug logs ...
    > ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
    > 2028: 895: S0: 15:47:07> :SR: Cmd 014c4c90, CxtG 74e60f44, WS
    > ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail
    -
    > Send Penalty]
    > ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
    > 2028: 868: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
    > ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail
    -
    > rpc call]
    > ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
    > 2028: 895: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
    > ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail
    -
    > Send Penalty]
    > ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate
    that
    > DNS returns the IP address of the wrong computer. Check DNS records
    > being returned, Check if FRS is currently running on the target
    server.
    > Check if Ntfrs is registered with the End-Point-Mapper on target
    > server!)" : <SndCsMain: 1684: 874: S0:
    17:59:47>
    > ++ ERROR - EXCEPTION (000006d9) : WStatus: EPT_S_NOT_REGISTERED
    > ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate
    that
    > DNS returns the IP address of the wrong computer. Check DNS records
    > being returned, Check if FRS is currently running on the target
    server.
    > Check if Ntfrs is registered with the End-Point-Mapper on target
    > server!)" : <SndCsMain: 1684: 875: S0:
    17:59:47>
    > :SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
    > HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - rpc exception]
    > ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate
    that
    > DNS returns the IP address of the wrong computer. Check DNS records
    > being returned, Check if FRS is currently running on the target
    server.
    > Check if Ntfrs is registered with the End-Point-Mapper on target
    > server!)" : <SndCsMain: 1684: 895: S0:
    17:59:47>
    > :SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
    > HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - Send Penalty]
    >
    > Found 24404 ERROR_RETRY error(s)! Latest ones (up to 3) listed above
    > Found 3 EPT_S_NOT_REGISTERED error(s)! Latest ones (up to 3) listed
    > above
    >
    > ......... failed with 24407 error entries
    > Checking NtFrs Service (and dependent services) state...passed
    > Checking NtFrs related Registry Keys for possible problems...passed
    > Checking Repadmin Showreps for errors...passed
    >
    >
    > So I attempted to find out more about the RPC End Point Mapper and
    came
    > up empty.
    >
    > Any more ideas on how to run this down?
    >
    > Thanks
    > Gordon
    >
    > Denis Wong @ Hong Kong wrote:
    > >
    > > Have you tried to use the FRSDiag to troubleshoot?
    > >
    > >
    > > br,
    > > Denis
    > >
    > > "Gordon" wrote:
    > >
    > > > Greetings-
    > > >
    > > > I have a rather simple, single domain with two DC's running fully
    > > > patched Windows 2000 Server and 3 other member servers, 2 of
    which
    > are
    > > > running fully patched Windows 2000 Server and the other fully
    > patched
    > > > Windows 2003 server (my exchange 2003 host).
    > > >
    > > > One DC, shown as DC1 below in the event log text, has exactly one
    > 13508
    > > > warning per day in the event log.
    > > >
    > > > I've never seen a corresponding 13509 or 1265 event on either DC.
    > > >
    > > > I've run the full series of tests using DcDiag and NetDiag and no
    > > > errors are reported in the resulting logs.
    > > >
    > > > The SRV records appear to be correctly set on both DC's DNS.
    > > >
    > > > The permissions on the Sysvol share are set correctly.
    > > >
    > > > Time syncing is from DC1 and is functioning properly.
    > > >
    > > > This one has me a bit baffled as I do not know what is causing
    the
    > > > event nor do I know if it is critical problem that needs to be
    > > > addressed or if it is something that is more of an annoyance
    event
    > > > warning than anything else.
    > > >
    > > >
    > > > Any thoughts, suggestions, troubleshooting ideas appreciated.
    > > > Thx
    > > > Gordon Pegue
    > > >
    > > >
    > > >
    > > >
    > > > Event Type: Warning
    > > > Event Source: NtFrs
    > > > Event Category: None
    > > > Event ID: 13508
    > > > Date: 1/8/2005
    > > > Time: 5:57:25 AM
    > > > User: N/A
    > > > Computer: DC1
    > > > Description:
    > > > The File Replication Service is having trouble enabling
    replication
    > > > from DC2 to DC1 for c:\winnt\sysvol\domain using the DNS name
    > > > DC2.cg-engrs.cg-engrs.com.
    > > >
    > > > FRS will keep retrying.
    > > >
    > > > Following are some of the reasons you would see this warning.
    > > >
    > > > [1] FRS can not correctly resolve the DNS name
    > > > DC2.cg-engrs.cg-engrs.com from this computer.
    > > > [2] FRS is not running on DC2.cg-engrs.cg-engrs.com.
    > > > [3] The topology information in the Active Directory for this
    > replica
    > > > has not yet replicated to all the Domain Controllers.
    > > >
    > > > This event log message will appear once per connection.
    > > > After the problem is fixed you will see another event log message
    > > > indicating that the connection has been established.
    > > >
    > > >
  5. Archived from groups: microsoft.public.win2000.active_directory (More info?)

    Been there, done that, no help with the end point mapper issue that
    appears to be the cause of the errors.

    Gordon


    ptwilliams wrote:
    > If you haven't already, have a look at this:
    > --
    >
    http://www.eventid.net/display.asp?eventid=13508&eventno=349&source=NtFrs&phase=1
    >
    >
    > --
    >
    > Paul Williams
    >
    > http://www.msresource.net
    > http://forums.msresource.net
    >
    >
    > "Gordon Pegue" <gpegue@cg-engrs.com> wrote in message
    > news:1106182568.389558.88010@c13g2000cwb.googlegroups.com...
    > Anyone else have any ideas on this?
    >
    > Gordon
    >
    > Gordon Pegue wrote:
    > > Finally, yes. Pretty good tool but I'm mystified by the results.
    > > I ran all tests and they reported as passed EXCEPT for the
    > FRSDiag.txt
    > > report, included here:
    > >
    > > ------------------------------------------------------------
    > > FRSDiag v1.7 on 1/17/2005 3:56:20 PM
    > > .\Logs\MORRISON on 2005-01-17 at 3.56.20 PM
    > > ------------------------------------------------------------
    > >
    > > Checking for minimum FRS version requirement ... passed
    > > Checking for errors/warnings in ntfrsutl ds ... passed
    > > Checking for Replica Set configuration triggers... passed
    > > Checking for suspicious file Backlog size... passed
    > > Checking Overall Disk Space and SYSVOL structure (note: integrity
    is
    > > not checked)... passed
    > > Checking for suspicious inlog entries ... passed
    > > Checking for suspicious outlog entries ... passed
    > > Checking for appropriate staging area size ... passed
    > > Checking for errors in debug logs ...
    > > ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
    > > 2028: 895: S0: 15:47:07> :SR: Cmd 014c4c90, CxtG 74e60f44, WS
    > > ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370)
    [SndFail
    > -
    > > Send Penalty]
    > > ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
    > > 2028: 868: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
    > > ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370)
    [SndFail
    > -
    > > rpc call]
    > > ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
    > > 2028: 895: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
    > > ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370)
    [SndFail
    > -
    > > Send Penalty]
    > > ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate
    > that
    > > DNS returns the IP address of the wrong computer. Check DNS records
    > > being returned, Check if FRS is currently running on the target
    > server.
    > > Check if Ntfrs is registered with the End-Point-Mapper on target
    > > server!)" : <SndCsMain: 1684: 874: S0:
    > 17:59:47>
    > > ++ ERROR - EXCEPTION (000006d9) : WStatus: EPT_S_NOT_REGISTERED
    > > ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate
    > that
    > > DNS returns the IP address of the wrong computer. Check DNS records
    > > being returned, Check if FRS is currently running on the target
    > server.
    > > Check if Ntfrs is registered with the End-Point-Mapper on target
    > > server!)" : <SndCsMain: 1684: 875: S0:
    > 17:59:47>
    > > :SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
    > > HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - rpc exception]
    > > ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate
    > that
    > > DNS returns the IP address of the wrong computer. Check DNS records
    > > being returned, Check if FRS is currently running on the target
    > server.
    > > Check if Ntfrs is registered with the End-Point-Mapper on target
    > > server!)" : <SndCsMain: 1684: 895: S0:
    > 17:59:47>
    > > :SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
    > > HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - Send Penalty]
    > >
    > > Found 24404 ERROR_RETRY error(s)! Latest ones (up to 3) listed
    above
    > > Found 3 EPT_S_NOT_REGISTERED error(s)! Latest ones (up to 3) listed
    > > above
    > >
    > > ......... failed with 24407 error entries
    > > Checking NtFrs Service (and dependent services) state...passed
    > > Checking NtFrs related Registry Keys for possible problems...passed
    > > Checking Repadmin Showreps for errors...passed
    > >
    > >
    > > So I attempted to find out more about the RPC End Point Mapper and
    > came
    > > up empty.
    > >
    > > Any more ideas on how to run this down?
    > >
    > > Thanks
    > > Gordon
    > >
    > > Denis Wong @ Hong Kong wrote:
    > > >
    > > > Have you tried to use the FRSDiag to troubleshoot?
    > > >
    > > >
    > > > br,
    > > > Denis
    > > >
    > > > "Gordon" wrote:
    > > >
    > > > > Greetings-
    > > > >
    > > > > I have a rather simple, single domain with two DC's running
    fully
    > > > > patched Windows 2000 Server and 3 other member servers, 2 of
    > which
    > > are
    > > > > running fully patched Windows 2000 Server and the other fully
    > > patched
    > > > > Windows 2003 server (my exchange 2003 host).
    > > > >
    > > > > One DC, shown as DC1 below in the event log text, has exactly
    one
    > > 13508
    > > > > warning per day in the event log.
    > > > >
    > > > > I've never seen a corresponding 13509 or 1265 event on either
    DC.
    > > > >
    > > > > I've run the full series of tests using DcDiag and NetDiag and
    no
    > > > > errors are reported in the resulting logs.
    > > > >
    > > > > The SRV records appear to be correctly set on both DC's DNS.
    > > > >
    > > > > The permissions on the Sysvol share are set correctly.
    > > > >
    > > > > Time syncing is from DC1 and is functioning properly.
    > > > >
    > > > > This one has me a bit baffled as I do not know what is causing
    > the
    > > > > event nor do I know if it is critical problem that needs to be
    > > > > addressed or if it is something that is more of an annoyance
    > event
    > > > > warning than anything else.
    > > > >
    > > > >
    > > > > Any thoughts, suggestions, troubleshooting ideas appreciated.
    > > > > Thx
    > > > > Gordon Pegue
    > > > >
    > > > >
    > > > >
    > > > >
    > > > > Event Type: Warning
    > > > > Event Source: NtFrs
    > > > > Event Category: None
    > > > > Event ID: 13508
    > > > > Date: 1/8/2005
    > > > > Time: 5:57:25 AM
    > > > > User: N/A
    > > > > Computer: DC1
    > > > > Description:
    > > > > The File Replication Service is having trouble enabling
    > replication
    > > > > from DC2 to DC1 for c:\winnt\sysvol\domain using the DNS name
    > > > > DC2.cg-engrs.cg-engrs.com.
    > > > >
    > > > > FRS will keep retrying.
    > > > >
    > > > > Following are some of the reasons you would see this warning.
    > > > >
    > > > > [1] FRS can not correctly resolve the DNS name
    > > > > DC2.cg-engrs.cg-engrs.com from this computer.
    > > > > [2] FRS is not running on DC2.cg-engrs.cg-engrs.com.
    > > > > [3] The topology information in the Active Directory for this
    > > replica
    > > > > has not yet replicated to all the Domain Controllers.
    > > > >
    > > > > This event log message will appear once per connection.
    > > > > After the problem is fixed you will see another event log
    message
    > > > > indicating that the connection has been established.
    > > > >
    > > > >
  6. Archived from groups: microsoft.public.win2000.active_directory (More info?)

    Apologies for the delay, I missed your last post!

    So you're having RPC errors? This is usually indicative of DNS problems.

    Try this:

    -- Load the DNS snap-in and navigate down to the _msdcs dub-domain. Check
    all entries in here to see if there are any rogue/ out-of-date entries, i.e.
    incorrect server names, site names that don't correspond to current sites,
    etc. If there are any suspect entries, delete them.
    -- Point both DCs at one DC for DNS name-resolution.
    -- Ensure that the DHCP client service is set to automatically start and is
    running on both DCs.
    -- Restart the netlogon service
    -- Go make a cup of coffee.
    -- Change the DNS settings back to what they were once were.

    -- Flush the NtFrs event log.
    -- Restart the NtFrs service
    -- Run aforementioned tests again.

    If, after this you're still getting NtFrs problems I'd perform a
    non-authorative restore on the DC that is showing these errors. Post back
    if you want help with this, but this is probably not the issue.

    Are both of these DCs in the same site? If not, are they separated by a
    firewall or intelligent device that can filter/ block ports and traffic?


    --

    Paul Williams

    http://www.msresource.net
    http://forums.msresource.net


    "Gordon Pegue" <gpegue@cg-engrs.com> wrote in message
    news:1106236102.709622.145330@f14g2000cwb.googlegroups.com...
    Been there, done that, no help with the end point mapper issue that
    appears to be the cause of the errors.

    Gordon


    ptwilliams wrote:
    > If you haven't already, have a look at this:
    > --
    >
    http://www.eventid.net/display.asp?eventid=13508&eventno=349&source=NtFrs&phase=1
    >
    >
    > --
    >
    > Paul Williams
    >
    > http://www.msresource.net
    > http://forums.msresource.net
    >
    >
    > "Gordon Pegue" <gpegue@cg-engrs.com> wrote in message
    > news:1106182568.389558.88010@c13g2000cwb.googlegroups.com...
    > Anyone else have any ideas on this?
    >
    > Gordon
    >
    > Gordon Pegue wrote:
    > > Finally, yes. Pretty good tool but I'm mystified by the results.
    > > I ran all tests and they reported as passed EXCEPT for the
    > FRSDiag.txt
    > > report, included here:
    > >
    > > ------------------------------------------------------------
    > > FRSDiag v1.7 on 1/17/2005 3:56:20 PM
    > > .\Logs\MORRISON on 2005-01-17 at 3.56.20 PM
    > > ------------------------------------------------------------
    > >
    > > Checking for minimum FRS version requirement ... passed
    > > Checking for errors/warnings in ntfrsutl ds ... passed
    > > Checking for Replica Set configuration triggers... passed
    > > Checking for suspicious file Backlog size... passed
    > > Checking Overall Disk Space and SYSVOL structure (note: integrity
    is
    > > not checked)... passed
    > > Checking for suspicious inlog entries ... passed
    > > Checking for suspicious outlog entries ... passed
    > > Checking for appropriate staging area size ... passed
    > > Checking for errors in debug logs ...
    > > ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
    > > 2028: 895: S0: 15:47:07> :SR: Cmd 014c4c90, CxtG 74e60f44, WS
    > > ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370)
    [SndFail
    > -
    > > Send Penalty]
    > > ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
    > > 2028: 868: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
    > > ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370)
    [SndFail
    > -
    > > rpc call]
    > > ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
    > > 2028: 895: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
    > > ERROR_RETRY, To HENDRIX.cg-engrs.cg-engrs.com Len: (370)
    [SndFail
    > -
    > > Send Penalty]
    > > ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate
    > that
    > > DNS returns the IP address of the wrong computer. Check DNS records
    > > being returned, Check if FRS is currently running on the target
    > server.
    > > Check if Ntfrs is registered with the End-Point-Mapper on target
    > > server!)" : <SndCsMain: 1684: 874: S0:
    > 17:59:47>
    > > ++ ERROR - EXCEPTION (000006d9) : WStatus: EPT_S_NOT_REGISTERED
    > > ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate
    > that
    > > DNS returns the IP address of the wrong computer. Check DNS records
    > > being returned, Check if FRS is currently running on the target
    > server.
    > > Check if Ntfrs is registered with the End-Point-Mapper on target
    > > server!)" : <SndCsMain: 1684: 875: S0:
    > 17:59:47>
    > > :SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
    > > HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - rpc exception]
    > > ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate
    > that
    > > DNS returns the IP address of the wrong computer. Check DNS records
    > > being returned, Check if FRS is currently running on the target
    > server.
    > > Check if Ntfrs is registered with the End-Point-Mapper on target
    > > server!)" : <SndCsMain: 1684: 895: S0:
    > 17:59:47>
    > > :SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
    > > HENDRIX.cg-engrs.cg-engrs.com Len: (370) [SndFail - Send Penalty]
    > >
    > > Found 24404 ERROR_RETRY error(s)! Latest ones (up to 3) listed
    above
    > > Found 3 EPT_S_NOT_REGISTERED error(s)! Latest ones (up to 3) listed
    > > above
    > >
    > > ......... failed with 24407 error entries
    > > Checking NtFrs Service (and dependent services) state...passed
    > > Checking NtFrs related Registry Keys for possible problems...passed
    > > Checking Repadmin Showreps for errors...passed
    > >
    > >
    > > So I attempted to find out more about the RPC End Point Mapper and
    > came
    > > up empty.
    > >
    > > Any more ideas on how to run this down?
    > >
    > > Thanks
    > > Gordon
    > >
    > > Denis Wong @ Hong Kong wrote:
    > > >
    > > > Have you tried to use the FRSDiag to troubleshoot?
    > > >
    > > >
    > > > br,
    > > > Denis
    > > >
    > > > "Gordon" wrote:
    > > >
    > > > > Greetings-
    > > > >
    > > > > I have a rather simple, single domain with two DC's running
    fully
    > > > > patched Windows 2000 Server and 3 other member servers, 2 of
    > which
    > > are
    > > > > running fully patched Windows 2000 Server and the other fully
    > > patched
    > > > > Windows 2003 server (my exchange 2003 host).
    > > > >
    > > > > One DC, shown as DC1 below in the event log text, has exactly
    one
    > > 13508
    > > > > warning per day in the event log.
    > > > >
    > > > > I've never seen a corresponding 13509 or 1265 event on either
    DC.
    > > > >
    > > > > I've run the full series of tests using DcDiag and NetDiag and
    no
    > > > > errors are reported in the resulting logs.
    > > > >
    > > > > The SRV records appear to be correctly set on both DC's DNS.
    > > > >
    > > > > The permissions on the Sysvol share are set correctly.
    > > > >
    > > > > Time syncing is from DC1 and is functioning properly.
    > > > >
    > > > > This one has me a bit baffled as I do not know what is causing
    > the
    > > > > event nor do I know if it is critical problem that needs to be
    > > > > addressed or if it is something that is more of an annoyance
    > event
    > > > > warning than anything else.
    > > > >
    > > > >
    > > > > Any thoughts, suggestions, troubleshooting ideas appreciated.
    > > > > Thx
    > > > > Gordon Pegue
    > > > >
    > > > >
    > > > >
    > > > >
    > > > > Event Type: Warning
    > > > > Event Source: NtFrs
    > > > > Event Category: None
    > > > > Event ID: 13508
    > > > > Date: 1/8/2005
    > > > > Time: 5:57:25 AM
    > > > > User: N/A
    > > > > Computer: DC1
    > > > > Description:
    > > > > The File Replication Service is having trouble enabling
    > replication
    > > > > from DC2 to DC1 for c:\winnt\sysvol\domain using the DNS name
    > > > > DC2.cg-engrs.cg-engrs.com.
    > > > >
    > > > > FRS will keep retrying.
    > > > >
    > > > > Following are some of the reasons you would see this warning.
    > > > >
    > > > > [1] FRS can not correctly resolve the DNS name
    > > > > DC2.cg-engrs.cg-engrs.com from this computer.
    > > > > [2] FRS is not running on DC2.cg-engrs.cg-engrs.com.
    > > > > [3] The topology information in the Active Directory for this
    > > replica
    > > > > has not yet replicated to all the Domain Controllers.
    > > > >
    > > > > This event log message will appear once per connection.
    > > > > After the problem is fixed you will see another event log
    message
    > > > > indicating that the connection has been established.
    > > > >
    > > > >
Ask a new question

Read More

Servers Active Directory Windows