Event ID 13552 and 13559 on DFS Replica Members or Domain Controllers That Are Hosting a SYSVOL Replica Set


On Distributed File System (DFS) replica members or domain controllers that are hosting a SYSVOL replica set, you may find an event that is similar to the following in Event Viewer: You may also see events that are similar to the following: -or-


This problem may occur after you apply the fix that is described in the following Microsoft Knowledge Base article:
811370 Issues That Are Fixed in the Post-Service Pack 3 Release of Ntfrs.exe
This hotfix changes the File Replication service (FRS) on a computer that is running Windows 2000 Service Pack 3 (SP3) or later to improve the robustness of the service. To do this, the hotfix increases the size of the USN Journal (also known as the change-notification log) from 128 megabytes (MB) to 512 MB. The first time the FRS starts after the service has been updated, it tries to increase the size of the existing USN Journal on each volume that contains an FRS replica set. If a hard disk does not have sufficient free space to contain the journal file, the USN Journal cannot initialize; therefore, it logs the event in Event Viewer.


To work around this issue, use any of the following methods. Microsoft recommends that you try Method 1 or Method 2 before you use Method 3.

Method 1: Delete Files to Create Additional Disk Space

To free up additional disk space on the volume that hosts the FRS replica set to handle the 512-MB USN Journal, follow these steps:
  1. Open Command Prompt, and then do any of the following:
    • To delete unused temporary (temp) files or cached Internet browser files, type the following commands, and then press ENTER after each command:
      cd /d Your_FRS_ drive\
      del *.tmp /s
    • To delete user files or memory dump files, type the following commands, and then press ENTER after each command:
      cd /d Your_FRS_ drive\
      del *.dmp /s
    • To delete the symbols in the %systemroot%\Symbols folder, type the following commands, and then press ENTER after each command:
      rd /s %systemroot%\symbols
      Depending on whether the servers have a full or small symbol set, this may free up approximately 70 MB to 600 MB.
  2. Follow these steps to delete the user profiles for old or unused user accounts. Do not delete any profiles that may be for service accounts.
    1. Right-click My Computer, click Properties, and then click the User Profiles tab.
    2. In Profiles stored on this computer, click a profile that you want to remove, and then click Delete.
  3. Temporarily remove or relocate files that you can access from other servers or that you can easily reinstall. Files that you can remove and easily reinstall include Windows 2000 Administrative Tools, other support tools that you have installed on the computer, and all the files in the %systemroot%\System32\Dllcache folder.

Method 2: Move the File Replication Service Staging Folder

Move the FRS Staging Folder to a hard disk that has sufficient free space to host the replica set and the 512-MB USN Journal.For additional information about how to move the FRS Staging Folder, click the following article number to view the article in the Microsoft Knowledge Base:
291823 How to Reset the File Replication Service Staging Folder to a Different Logical Drive

Method 3: Set the USN Journal Size Back to 128 MB

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows

Microsoft recommends that you use Method 1 or Method 2 to work around this problem. If you cannot use one of these methods, or if they do not work around the problem, you can set the USN Journal size back to 128 MB. This method must be applied before you restart your computer or before you restart FRS. If FRS is started after you apply the 811370 hotfix, you must reformat all volumes that contain FRS-replicated content to decrease the USN Journal size.

To set the USN Journal size back to 128 MB, before you restart FRS, and after you have applied the 811370 hotfix, follow these steps:
  1. Click Start, click Run, type regedit, and then click OK.
  2. Locate and then click the following registry subkey:
  3. Look in the Name column. If the Ntfs Journal size in MB entry does not exist, follow these steps to create it:
    1. Click the Parameters subkey. On the Edit menu, point to New, and then click DWORD Value.
    2. Type Ntfs Journal size in MB, and then press ENTER.
  4. Double-click the Ntfs Journal size in MB entry.
  5. In the Value box, type 128, click Decimal under Base, and then click OK.
  6. Quit Registry Editor.
  7. Click Start, point to Programs, point to Administrative Tools, and then click Services.
  8. In Services, right-click File Replication, and then click Start.
  9. Restart your computer.


Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

More Information

For additional information about troubleshooting FRS problems, click the following article numbers to view the articles in the Microsoft Knowledge Base:
329491 Configuring Correct Staging Area Space for Replica Sets
292438 Troubleshooting Journal_Wrap Errors on Sysvol and DFS Replica Sets
221111 Description of FRS Entries in the Registry