ntfrs event id 13508

From JSI Tip 5439 we read:
The subject problem generally only occurs when you restore the only domain controller in the domain, or you restore all the domain controllers in the domain.

NOTE: If you run Dcdiag.exe, the FsmoCheck fails with:

Warning: DcGetDcName(GC_SERVER_REQUIRED) call failed, error 1355.

When you restore a domain controller, the FRS database is NOT restored, because a current replica is assumed to have the most current database. FRS tries to locate a replica to synchronize with and until it complete replication, it can NOT share the Sysvol and Netlogon shares. If you restore all the domain controllers, no replica can be found because they are all searching.

To fix the problem, you must designate a domain controller to be authoritative for the Sysvol replica set:

1. Stop the File Replication service on the PDC emulator FSMO role holder.

2. Use the Registry Editor to navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Paramaters\Backup|Restore\Process at Startup.

3. Double-click the BurFlags Value Name, a REG_DWORD data type, and set the data value to D4, using the Hex radix.

4. Exit the Registry Editor.

5. Start the File Replication service.

NOTE: If the BurFlags Value Name is set to D4 (authoritative) on more that one replica, conflicts and collisions will occur.

File Replication Service event log contains 13552 and 13555 events

From JSI Tip 3605 we read:
The most likely cause of these errors is that the FRS Jet database, or a Jet database log file, is corrupt. To fix the problem:

1. Open a CMD prompt on the domain controller and stop the NetLogon and Ntfrs services:

net stop NetLogon
net stop Ntfrs

2. Type:

del %systemroot%\ntfrs\jet\Ntfrs.jdb
del %systemroot%\ntfrs\jet\Sys\Edb.chk
del %systemroot%\ntfrs\jet\log\edb.log
del %systemroot%\ntfrs\jet\log\res1.log
del %systemroot%\ntfrs\jet\log\res2.log

3. Type:

net start NetLogon
net start Ntfrs

4. Check the FRS event log for expected warning 13514 and 13520.

5. Close the FRS event log and go get a cup of coffee.

6. In five minutes, recheck the FRS event log for informational messages 13553, 13554, and 13516.