none
Error Event 13516 NtFrs & Warning Event 906 ESENT on 2012 DC RRS feed

  • Question

  • I have two Server 2012 DCs, a physical and a virtual.  I recently moved the all the roles from the virtual to the physical.  Last week, I received this error...

    "The File Replication Service has detected that the replica root path has changed from "c:\windows\sysvol\domain" to "c:\windows\sysvol\domain". If this is an intentional move then a file with the name NTFRS_CMD_FILE_MOVE_ROOT needs to be created under the new root path.
    This was detected for the following replica set:
        "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
    Changing the replica root path is a two step process which is triggered by the creation of the NTFRS_CMD_FILE_MOVE_ROOT file.
     [1] At the first poll which will occur in 5 minutes this computer will be deleted from the replica set.
     [2] At the poll following the deletion this computer will be re-added to the replica set with the new root path. This re-addition will trigger a full tree sync for the replica set. At the end of the sync all the files will be at the new location. The files may or may not be deleted from the old location depending on whether they are needed or not."

    ...on the physical server.  I restarted the NtFrs service on the physical DC. 


    Since moving the roles to the physical, I received warning 906, ESENT...

    "A significant portion of the database buffer cache has been written out to the system paging file. This may result in severe performance degradation."

    ...a couple of times. 

    Maybe the two are related.  Reading this KB...https://support.microsoft.com/en-us/kb/2768745, Microsoft says that NtFrs is for Windows 2003 DCs only.  Since I no longer have any 2003 DCs, should I just disable the NtFrs services on my 2012 servers?  The DFS Replication service is running on both servers but I never did anything to configure it to take over.

    Monday, November 9, 2015 7:30 PM

All replies

  • Hi MIS Admin,

    It seems the issue is more related with DS, I will move it to DS forum, maybe you can get better help there.

    Thanks for your understanding.

    Best Regards,

    Anne


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Tuesday, November 10, 2015 8:01 AM
    Moderator
  • Hi,

    Can you please past the out put of following command. Upload the log files to common area like one dirve etc.. share the URL here

    DCDIAG /V /c /d /e /s:contoso.com >>DCDIAG.log

    Repadmin /Replsum /errorsonly

    Repadmin /SHOWREPL * >>ReplicationStatus.txt

    dfsrmig /Getglobalstate

    Tuesday, November 10, 2015 10:17 AM
  • Hi.  Everything passed in the DCDIAG log and I will post it when I find a good site to share it.

    The other commands have limited info...

    C:\>Repadmin /replsum /errorsonly

    Source DSA          largest delta    fails/total %%   error
     svr-dc1                 09m:41s    0 /   5    0
     vm-dc1                  03m:51s    0 /   5    0

    Destination DSA     largest delta    fails/total %%   error
     svr-dc1                 03m:51s    0 /   5    0
     vm-dc1                  09m:41s    0 /   5    0

    C:\>repadmin /SHOWREPL

    Repadmin: running command /SHOWREPL against full DC vm-dc1.company.local

    Default-First-Site-Name\vm-dc1
    DSA Options: IS_GC
    Site Options: (none)
    DSA object GUID: 2329e1cf-ee8a-4113-acc4-47f6ded37116
    DSA invocationID: aa4ce7d2-41ef-4bdd-abcd-bd696645822a

    ==== INBOUND NEIGHBORS ======================================

    DC=company,DC=local
        Default-First-Site-Name\svr-dc1 via RPC
            DSA object GUID: fb356743-aaf4-44de-8cc2-79fb41bce5f8
            Last attempt @ 2015-11-10 09:59:03 was successful.
    CN=Configuration,DC=company,DC=local
        Default-First-Site-Name\svr-dc1 via RPC
            DSA object GUID: fb356743-aaf4-44de-8cc2-79fb41bce5f8
            Last attempt @ 2015-11-10 09:49:07 was successful.
    CN=Schema,CN=Configuration,DC=company,DC=local
        Default-First-Site-Name\svr-dc1 via RPC
            DSA object GUID: fb356743-aaf4-44de-8cc2-79fb41bce5f8
            Last attempt @ 2015-11-10 09:49:07 was successful.
    DC=DomainDnsZones,DC=company,DC=local
        Default-First-Site-Name\svr-dc1 via RPC
            DSA object GUID: fb356743-aaf4-44de-8cc2-79fb41bce5f8
            Last attempt @ 2015-11-10 09:56:18 was successful.
    DC=ForestDnsZones,DC=company,DC=local
        Default-First-Site-Name\svr-dc1 via RPC
            DSA object GUID: fb356743-aaf4-44de-8cc2-79fb41bce5f8
            Last attempt @ 2015-11-10 09:49:07 was successful.

    Repadmin: running command /SHOWREPL against full DC svr-dc1.company.local

    Default-First-Site-Name\svr-dc1
    DSA Options: IS_GC
    Site Options: (none)
    DSA object GUID: fb356743-aaf4-44de-8cc2-79fb41bce5f8
    DSA invocationID: 7994b09d-7882-4cba-b00e-205b649015c2

    ==== INBOUND NEIGHBORS ======================================

    DC=company,DC=local
        Default-First-Site-Name\vm-dc1 via RPC
            DSA object GUID: 2329e1cf-ee8a-4113-acc4-47f6ded37116
            Last attempt @ 2015-11-10 09:58:58 was successful.
    CN=Configuration,DC=company,DC=local
        Default-First-Site-Name\vm-dc1 via RPC
            DSA object GUID: 2329e1cf-ee8a-4113-acc4-47f6ded37116
            Last attempt @ 2015-11-10 09:54:57 was successful.
    CN=Schema,CN=Configuration,DC=company,DC=local
        Default-First-Site-Name\vm-dc1 via RPC
            DSA object GUID: 2329e1cf-ee8a-4113-acc4-47f6ded37116
            Last attempt @ 2015-11-10 09:54:57 was successful.
    DC=DomainDnsZones,DC=company,DC=local
        Default-First-Site-Name\vm-dc1 via RPC
            DSA object GUID: 2329e1cf-ee8a-4113-acc4-47f6ded37116
            Last attempt @ 2015-11-10 09:56:33 was successful.
    DC=ForestDnsZones,DC=company,DC=local
        Default-First-Site-Name\vm-dc1 via RPC
            DSA object GUID: 2329e1cf-ee8a-4113-acc4-47f6ded37116
            Last attempt @ 2015-11-10 09:54:57 was successful.

    C:\>dfsrmig /Getglobalstate

    The current domain functional level is not at least Windows Server 2008.
    DFSRMig is only supported on at least Windows Server 2008 level domains.



    • Edited by MIS Admin Tuesday, November 10, 2015 6:22 PM
    Tuesday, November 10, 2015 3:22 PM
  • Hi,

    I can see you are still using the NTFRS on your domain controller. what is the functional level on your environment. Also can you post the result of DcDIAG on on drive site which is safe and most the people in forum use that to upload the log files & trace files.

    https://onedrive.live.com/about/en-in/

    Wednesday, November 11, 2015 8:22 AM
  • Hi.  Our domain and forest functional level is Windows 2003.  We still have a few Windows 9x and 2000 PCs connecting to our domain.  The dcdiag is here... http://1drv.ms/1NqQawD

    Thanks.



    • Edited by MIS Admin Wednesday, November 11, 2015 1:54 PM
    Wednesday, November 11, 2015 12:53 PM
  • Hi,

    You have to go by article: https://support.microsoft.com/en-us/kb/2768745/

    As your domain functional level 2003 and it is still using the NTFRS for replication. Hence please go head with article steps and revert back.

    Wednesday, November 11, 2015 2:15 PM
  • Hi.  That's the article I mentioned in my original post.  What do you mean revert back?
    Wednesday, November 11, 2015 2:57 PM
  • Yes correct have you try implemented solution provided in KB. 
    Wednesday, November 11, 2015 3:10 PM
  • Yes...Step #1 as indicated in my first post which does not require an authoritative restore.  But is event 906 related?  And if not, what forum is best for event 906?

    Wednesday, November 11, 2015 3:40 PM
  •  But is event 906 related?  And if not, what forum is best for event 906?

    Event 906 may indicate that you do not have enough memory installed on the computer. How much memory does the server have? The minimum amount of RAM that is required for a multi-role server is 8 gigabytes (GB).
     
    Probably, add more memory if it is required, then try again.
     

    Regards,

    Ethan Hua


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Thursday, November 12, 2015 6:19 AM
    Moderator
  • Is there ESE related errors for event 906. do you have Exchange installed on server?
    Thursday, November 12, 2015 8:54 AM
  • The server has 4GB...as does the virtual.  This is the first time this warning has started appearing since I built the server in June '14.  I don't have Exchange installed.  Most of the articles I find about this warning deal with Exchange servers.  I found one referring to some other database that needed maintenance.  The warnings I'm getting refer to svchost.

     Around the time each one of these events is logged in the Application log, in the System log is...
    "The Windows Store Service (WSService) service entered the stopped state."  Prior to this event are events about Windows Update, WinHTTP Web Proxy Auto-Discovery Service, Windows Store Service, Windows Modules Installer Service entering the running state.

    I would like to rule out anything else if possible before buying more memory.

    Thursday, November 12, 2015 3:11 PM
  • If you haven't add any new roles into this server, probably some corruptions were cauing this low memory issue. So currently only AD role is installed on this server? are you experiencing any AD related issues?
    Monday, November 16, 2015 3:49 AM
  • Check the performance counter or Process explorer from Sysinternal tools and see handle count / thread count and working set for those process who utilising more memory.
    Monday, November 16, 2015 7:56 AM
  • I haven't added anything new to the server...except for monthly Windows Updates.  It runs DNS and DHCP and we are not experiencing any other noticeable AD issues.  The 906 warning has also started appearing on the virtual DC.  I'm using dynamic memory for it so I increased the maximum to 8GB. If it still happens on the virtual with 8GB maximum then it must be something else.
    • Edited by MIS Admin Monday, November 16, 2015 8:21 PM
    Monday, November 16, 2015 2:39 PM
  • Have you check what all patches recently installed on server. go to Control Panel\All Control Panel Items\Windows Update\View update history. sort by installed date and check what all patches have recently applied on the server.

    Monday, November 16, 2015 3:03 PM
  • I have Process Explorer on the server but I am not sure what I am looking for.  I see svchost (1128) which has 16 services registered in the process.
    Monday, November 16, 2015 3:58 PM
  • What all threads running by that process. check the thread count. Also which services are listed under that process?
    Monday, November 16, 2015 4:08 PM
  • Have you check what all patches recently installed on server. go to Control Panel\All Control Panel Items\Windows Update\View update history. sort by installed date and check what all patches have recently applied on the server.

    This first started early Sep on the physical server so it could have been any one of the updates from Aug...and there were 14 of them.  But it just started last week on the virtual server and that server has been getting the same updates as the physical. 
    Monday, November 16, 2015 4:22 PM
  • Thread Count is 42.  Services are...

    Application Information
    Background Intelligent Transfer Service
    Certificate Propagation
    Group Policy Client
    IKE and AuthIP IPsec Keying modules
    IP Helper
    Server
    User Profile Service
    Task Scheduler
    System Event Notification Service
    Remote Desktop Configuration
    Shell Hardware Detection
    System Events Broker
    Themes
    Windows Management Instrumentation

    Monday, November 16, 2015 5:33 PM
  • hi,

    have you check the Data base on DC. using the ntdsutil and see the semantic database analysis status.

    if you find any errors go fixup.

    1. Type the following command and then press ENTER:
    ntdsutil:
    2. At the ntdsutil: prompt, type semantic database analysis and then press ENTER.
    3. At the semantic checker: prompt, type verbose on and then press ENTER.
    4. At the semantic checker: prompt, type go fixup and then press ENTER.
    5. If errors are reported during the semantic database analysis Go Fixup phase, perform directory database recovery.

    Tuesday, November 17, 2015 5:52 AM
  • Microsoft says the semantic database analysis checks the AD semantics and not the ESENT semantics...which is what's throwing the error here.  I'm leaning towards a Windows Update/Windows Store Service related issue.  I have a "Windows Store service entered the stopped state" entry that corresponds with every 906 error.  The Software Distribution folder is huge on the two DCs compared to my other servers.  I reset the Windows Store and cleared the Windows Update cache with Disk Cleanup but it didn't help.
    Thursday, December 10, 2015 5:22 PM