Why I need to Enable Journal Wrap Automatic Restore


  • Hi Everyone,

    The error msg I found on the one of the additional domain controller.

     Log Name:      File Replication Service
    Source:        NtFrs
    Date:          4/11/2010 9:32:13 AM
    Event ID:      13568
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR.
     Replica set name is    : "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
     Replica root path is   : "c:\windows\sysvol\domain"
     Replica root volume is : "\\.\C:"
     A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found.  This can occur because of one of the following reasons.
     [1] Volume "\\.\C:" has been formatted.
     [2] The NTFS USN journal on volume "\\.\C:" has been deleted.
     [3] The NTFS USN journal on volume "\\.\C:" has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.
     [4] File Replication Service was not running on this computer for a long time.
     [5] File Replication Service could not keep up with the rate of Disk IO activity on "\\.\C:".
     Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.
     [1] At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run "net stop ntfrs" followed by "net start ntfrs" to restart the File Replication Service.
     [2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.
    WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.
    To change this registry parameter, run regedit.
    Click on Start, Run and type regedit.
    Click down the key path:
    Double click on the value name
       "Enable Journal Wrap Automatic Restore"
    and update the value.
    If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above.

    Why I need to Enable Journal Wrap Automatic Restore?

    Sunday, April 11, 2010 12:32 PM


All replies

  • To allow you recover from the current state - which prevents NTFRS replication from operating - as the message you posted above rather clearly states...


    Sunday, April 11, 2010 1:00 PM
  • Thanks for your reply Marcin.

    Setting BurFlags to D2 in registry " HKLM\ SYSTEM\ CurrentControlSet\ Services\ NtFrs\ Parameters\ 
    Backup/Restore\ Process at Startup " results the same thing.

    Any chance of corruption of ntds.dit after changing the settings in registry.



    Sunday, April 11, 2010 1:25 PM
  • I'm not aware of any negative implications as far as AD database is concerned. If you want to play it really safe, make sure to perform a system state backup on a DC that hosts valid replica of SYSVOL...


    Sunday, April 11, 2010 1:42 PM
  • I add the dword value 1 for "Enable Journal Wrap Automatic Restore".

    I see new eventid 13565 warning messages.

    How to resolve this issue. I mean Sysvol is missing from additional domain controller.

    Sunday, April 11, 2010 2:39 PM
  • This is an indication that non-authoritiative restore has been initiated. Give it some time...


    Sunday, April 11, 2010 3:04 PM
  • Well, As you said sysvol and netlogon generated after sometime.

    But, I found that on main domain controller policies folders and additional domain controller policies folders are not same some folders are missing from additional domain controller.

    Is there any special settings need to be check.

    Sunday, April 11, 2010 3:14 PM
  • Refer to

    You might want to also use any of the NTFRS troubleshooting utilities -


    • Marked as answer by Bruce-Liu Friday, April 23, 2010 8:10 AM
    Sunday, April 11, 2010 3:23 PM
  • Domain and additional domain controller are running on 2008 R2.

    Sunday, April 11, 2010 4:28 PM
  • You are using NTFRS to replicate SYSVOL - not DFS-R - correct? If so, then the info in these articles still applies...

    Once you fix your replication issue, you might want to consider switching to DFS-R...


    Sunday, April 11, 2010 5:59 PM
  • Thanks Marcin for your reply.

    How I confirm that it is working with NTFRS. Well how to switch to DFS-R as your per recommendation would you please let me know that.

    Monday, April 12, 2010 9:40 AM
  • Here is the link to switch the relication from frs to dfs-r


    You may run dcdiag it will give you your replication media either its from frs or dfr-s
    Monday, April 12, 2010 9:42 AM
  • Thanks Syed for your quick reply.


    Monday, April 12, 2010 9:51 AM
  • Make sure you correct your current issue first before you attempt migration...


    Monday, April 12, 2010 10:55 AM
  • Hi

    We have same issue.

    My question is if I set the Journal Wrap Auto Rebuild does it regenerate the Sysyol and Netlogon folders automatically?

    We have 3 x server 2003 standard.  Server 1 DC, Server 3 secondary DC.  The netlogon and sysvol shares are missing from server3.  Is that normal.

    I've virtualised server1 and set the auto rebuild on but it's looking for server3.  In the meantime it's deleted the netlogon and sysvol shares from server1, hence the above question.



    Saturday, December 04, 2010 3:02 PM
  • Hello Insight in Kent,

    Just found your own create one, which is allways better,so i removed all questions in this:

    Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Sunday, December 05, 2010 10:15 AM