none
sbs 2008 Journal Wrap error message event id 13568 help needed RRS feed

  • Question

  • Ive currently got a win2008 sbs server and a regular windows 2008 r2 standard dc machine.

    I am ultimately migrating away from sbs to external servers for everything and the old sbs2008 server will come out of production.

    I have thus far migrated exchange off of sbs as well as my file services etc.

    I am stumbling on removing my sbs server due to event id 13568 in the file replication logs.

    I ran dcdiag on my new domain controller and it had errors stating that it didn't have a sysvol or netlogon share. I thought this was odd. I went looking and found my sbs server has never replicated to my new server or so it would seem. I believe that the first time this happens it creates the shares needed.

    I then went over to my sbs2008 server and found that the FRS log contained the 13568 error stating that the server is having joural wrap errors.

    The fix it states, is to enable "Journal Wrap Automatic Restore" in the registry of the server by adding a DWORD key with the same name and adding a value of 1 to that key.

    I have a system state backup completed on my sbs 2008 server.

    1. is it safe to do this and will it bring anything offline?

    2. will this repair and then automatically start replicating with my other DC running 2008R2 standard once complete?

    I do not want to take the server offline if possible and I want to minimize issues with the domain /  active directory.

    I should note that I have already transferred the FSMO roles off of the SBS server to my 2008 standard server and users started experiencing issues getting to shares etc.

    I then transferred them back to the SBS server

    update: I have read an article that says to do the BURFLAGS registry setting of either d2 or d4 for non-authoritative or authoritative restore of this function. I cant post the link to the article (something about my account verification) but it did go on to say these are better less aggressive options than  doing the automatic recovery.

    If I do either the d2 or the d4 hex registry key...my same 2 questions above apply. Can anyone help out? most articles and links I am finding deal with 2000 and 2003. I am wondering if they also will apply to 2008?




    • Edited by inc012 Wednesday, November 7, 2012 8:09 PM
    Wednesday, November 7, 2012 6:53 PM

Answers

All replies

  • Hi:

    Either of the fixes you found should work.  Neither of them will break anything, or at least should not if you have a stable system otherwise.  Be sure you have a backup, several would be good.  And I would restart the SBS first, maybe more than once, just to be sure it is viable and so that any existing issues are not blamed on the fix. 


    Larry Struckmeyer[SBS-MVP]

    Thursday, November 8, 2012 12:05 AM
    Moderator
  • DO NOT ENABLE JRNL WRAP AUTO RESTORE!  That was written for a pre sp1 2003server.  Do the burflags method.  if The non-sbs server never replicated, you need to stop the netlogon and ntfrs services on it.  then, on the sbs server you need to make a copyof you sysvol (copy it to the desktop), and do a D4 restore.  Then restart ntfrs and netlogon on the non-sbs server should then replicate from the sbs server. 

    if the non-sbs server does in fact have a sysvol, then you need to do a non-authorative restore d2 on the sbs server. m


    Jeremy

    Thursday, November 8, 2012 6:28 AM
  • Hi,

    Event id 13568 indicates that you have got a Journal wrap error. You should start reading it from here:

    http://technet.microsoft.com/en-us/library/bb727056.aspx#EMAA

    Also see the blog here

    http://www.virmansec.com/blogs/skhairuddin/archive/2010/08/29/event-id-13568-journal-wrap-entries.aspx

    Regards,


    Arthur Li

    TechNet Community Support

    Thursday, November 8, 2012 6:37 AM
    Moderator
  • yes....I also found that AUTO RESTORE would have been a bad option.

    THanks so much for the replies.

    I have not done the burflags restore yet.

    From what I gather now:

    1. my new stand alone DC has never had the sysvol created so I should stop NFRS on it for now

    2. stop NFRS on my SBS server

    3. COPY off my SYSVol So I have its contents (Ive done this to the network already).

    4. DO a burflags D4 (authoritative) restore....and wait for my event logs to show its done

    5. Enable NFRS on SBS and check for errors

    6. IF there are no errors and it appears OK.......I should then re-enable NFRS on my stand alone DC and see if it replicates?

    Is that the plan of action best suited so far. I think my confusion today was.......do I need to stop the NFRS services on my existing stand alone DC as well and also.....do I do a D4 or a D2....

    Thursday, November 8, 2012 9:14 PM
  • 1. Normally for an Authoritative Restore you stop at NTFRS services on all Server's.

    2.Set burflags to D4 on a known good sysvol (I am assuming this to be your sbs server as sysvol doesn't even exist on the new server) then start NTFRS on this server.

    3.Set burflags to D2 on second server and start NTFRS.

    Thursday, November 8, 2012 9:53 PM
  • Hi,

     

    I would like to confirm what is the current situation? If there is anything that I can do for you, please do not hesitate to let me know, and I will be happy to help.

    Regards,

    Arthur Li

    TechNet Subscriber Support

    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.


    Arthur Li

    TechNet Community Support

    Monday, November 19, 2012 3:12 AM
    Moderator
  • OP here.

    It worked great. I was able to disable the replication on both....

    do an authoritative via the above post.....on my SBS server.

    Started FRS services.

    Did a non auth on the new server and started the FRS services.

    At that point everything worked great. Thank you very much for the guidance.

    Monday, December 3, 2012 10:28 PM
  • Hi Arthur,

    I realise this post is old but, do you remember on which server you had the FSMO roles at the moment you did this? I read that they were on the non-SBS. Did you place them on the SBS before doing so?

    thx,

    Koen

    Wednesday, September 27, 2017 9:21 AM