locked
DHCP Server Stoped every 40 hour RRS feed

  • 問題

  •  

    hello

     

        i am using server 2003 , these day the DHCP server will stoped about every 40 hour.

    i check the DHCP service it show started  but i can open the dhcp mmc it show can't found the DHCP server and all network printer can't print. when i restart the server all will normal runing.

       then i check the Even Viewer it record two error in file replication service as follow:

    Event Type: Error
    Event Source: NtFrs
    Event Category: None
    Event ID: 13568
    Date:  08/05/08
    Time:  10:54:03 AM
    User:  N/A
    Computer: DC1
    Description:
    The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR.

    ...........

    and one error found in Application  Event ID: 1030

     

    i would like to know the above error cause my DHCP stop or HDCP stop cause above error ? and how to solve the problems? Thank very much.

     

     

    2008年5月15日 上午 01:40

解答

  • Dear Customer,

     

    Thanks for posting!

     

    These two event logs can be due to various factors. Here are some general troubleshooting steps to resolve the issue:

    1. Run DFSUTIL /purgemupcache on the problem server and reboot.

    830676 Group Policy processing fails with Events 1058 and 1030 in Windows

    http://support.microsoft.com/?id=830676

     

    2. Make sure that the DFS client service is started on the faulty DC.

     

    3. Make sure that the DFS Server Service is started on the DC

     

    4. Ensure that Everyone has full control at the root drive.

     

    5. Make sure that SMB signing levels (Digitally sign server communication) match between DCs.  SMB signing policies write to the following registry keys:

     

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\param

    eters

    enablesecuritysignature [REG_DWORD] = 0x0

    requiresecuritysignature [REG_DWORD] = 0x0

     

    Note: If there is only 1 DC, you can temporarily disable SMB signing in the registry.  Go to:

     

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\lanmanserver\Parameters

     

    Set enablesecuritysignature to 0

    Set requiresecuritysignature to 0

     

    6. Make sure that all DCs have sysvol shared out and make sure that they contain the group policy objects that are failing to apply.  Run gpotool to look for problems.

     

    7. Make sure that "file and print sharing" as well as "client for MS networks" is enabled on the network adapter used for your Local Network

    connection.

     

    8. Make sure that the TCP/IP Netbios Helper service has not been stopped/disabled manually or by group policy.

     

    9. Apply the Secure DC template (securedc.inf) to the problem DC and then refresh group policy on the DC with gpupdate. For more information, see:

    816585 HOW TO: Apply Predefined Security Templates in Windows Server 2003

    http://support.microsoft.com/?id=816585

     

    10.  You can also refer to other possible causes reported by other Windows users at:

    http://www.eventid.net/display.asp?eventid=1058&source=Userenv

     

    If you have any concerns with the suggestions above, please feel free to post back. I will be happy to help!

     

    Sincerely,

    Tom Zhang, MCSE 2003

     

    2008年5月21日 上午 08:06
    版主

所有回覆

  • Dear Customer,

     

    Based on my research, the 13568 error message is logged because the requested data is not available due to the following series of events:

     

    - FRS uses the NTFS file system journal to track changes to files and to folders that are in a replica tree to propagate those changes to other members of the replica set.

    - If FRS does not record the changes, the journal wraps and FRS does not know which change to process next. FRS may not record the changes because:

                -           FRS is off for an extended period of time.

                            -or-

                -           The changes are occurring faster than FRS can process them.

     

    - To recover from this error state, FRS needs to:

     

                -           Re-initialize the content of the replicated directory.

                -           Resume tracking the NTFS journal from a known good starting point.

     

    To re-initialize the replica tree, FRS moves all content into the NTFRS_Pre-Existing folder, and then FRS rejoins the replica set by sourcing from an upstream partner. Based on the contents of the file, one of the following events occurs:

     

                -           If a file on the upstream partner is identical to the file that is in the NTFRS_Pre-Existing folder, the local copy is moved into the replica tree.

                -           If the file is different, or if new files have been added to the replica set, FRS replicates the update from the upstream partner and moves it into the replica tree.

     

    - During this procedure, the data on that particular member becomes unavailable.

     

    You may refer to the article 292438 in Windows Server 2003. If it doesn''t work, please change it back. Also, please try the following method.

     

    (1). Stop FRS.

    (2). Start Registry Editor (Regedt32.exe).

    (3). Locate and click the following key in the registry:

            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore/Process at Startup

    (4). On the Edit menu, click Add Value, and then add the following registry value:

            Value name: BurFlags

            Data type:  REG_DWORD

            Radix:      Hexadecimal

            Value data: D2

    (5). Quit Registry Editor.

    (6). Restart FRS.

     

    For more information on troubleshooting the FRS issues in Windows Server 2003, please refer to the following article. This step-by-step article describes how to troubleshoot the File Replication service (FRS). The following procedures are all performed by a member of the administrators group on a computer that is running Windows Server 2003 Enterprise Edition. This article may be useful if FRS has stopped replicating content on your computer.

     

    327341 HOW TO: Troubleshoot the File Replication Service in Windows Server 2003

    http://support.microsoft.com/?id=327341

     

    From the information you provided it is hard to know what caused your problem.
    1. You should check the event log. See if it provides any hint to the dhcp problem.


    Hope it helps. If you have any further question or concern on this issue, please don't hesitate to post back.

     

    Have a nice day!

     

    Sincerely,

    Tom Zhang, MCSE 2003

    2008年5月15日 上午 10:26
    版主
  • Dear Customer,

     

    Based on my research, the 13568 error message is logged because the requested data is not available due to the following series of events:

     

    - FRS uses the NTFS file system journal to track changes to files and to folders that are in a replica tree to propagate those changes to other members of the replica set.

    - If FRS does not record the changes, the journal wraps and FRS does not know which change to process next. FRS may not record the changes because:

                -           FRS is off for an extended period of time.

                            -or-

                -           The changes are occurring faster than FRS can process them.

     

    - To recover from this error state, FRS needs to:

     

                -           Re-initialize the content of the replicated directory.

                -           Resume tracking the NTFS journal from a known good starting point.

     

    To re-initialize the replica tree, FRS moves all content into the NTFRS_Pre-Existing folder, and then FRS rejoins the replica set by sourcing from an upstream partner. Based on the contents of the file, one of the following events occurs:

     

                -           If a file on the upstream partner is identical to the file that is in the NTFRS_Pre-Existing folder, the local copy is moved into the replica tree.

                -           If the file is different, or if new files have been added to the replica set, FRS replicates the update from the upstream partner and moves it into the replica tree.

     

    - During this procedure, the data on that particular member becomes unavailable.

     

    You may refer to the article 292438 in Windows Server 2003. If it doesn''t work, please change it back. Also, please try the following method.

     

    (1). Stop FRS.

    (2). Start Registry Editor (Regedt32.exe).

    (3). Locate and click the following key in the registry:

            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore/Process at Startup

    (4). On the Edit menu, click Add Value, and then add the following registry value:

            Value name: BurFlags

            Data type:  REG_DWORD

            Radix:      Hexadecimal

            Value data: D2

    (5). Quit Registry Editor.

    (6). Restart FRS.

     

    For more information on troubleshooting the FRS issues in Windows Server 2003, please refer to the following article. This step-by-step article describes how to troubleshoot the File Replication service (FRS). The following procedures are all performed by a member of the administrators group on a computer that is running Windows Server 2003 Enterprise Edition. This article may be useful if FRS has stopped replicating content on your computer.

     

    327341 HOW TO: Troubleshoot the File Replication Service in Windows Server 2003

    http://support.microsoft.com/?id=327341

     

    From the information you provided it is hard to know what caused your problem.
    1. You should check the event log. See if it provides any hint to the dhcp problem.


    Hope it helps. If you have any further question or concern on this issue, please don't hesitate to post back.

     

    Have a nice day!

     

    Sincerely,

    Tom Zhang, MCSE 2003

    2008年5月15日 上午 10:27
    版主
  • Dear Support,

     

    Thank for your help. I would like to show you the errors details in my even log.

    Even Log in Application:

     

    Event Type: Error
    Event Source: Userenv
    Event Category: None
    Event ID: 1030
    Date:  15/05/08
    Time:  6:39:23 AM
    User:  NT AUTHORITY\SYSTEM
    Computer: DC1
    Description:
    Windows cannot query for the list of Group Policy objects.
    Check the event log for possible messages previously logged by
    the policy engine that describes the reason for this.

    Event Type: Error
    Event Source: Userenv
    Event Category: None
    Event ID: 1053
    Date:  15/05/08
    Time:  7:09:24 AM
    User:  NT AUTHORITY\SYSTEM
    Computer: DC1
    ...................................................................

    Even log "File Replication Service"

     

    Event Type: Error
    Event Source: NtFrs
    Event Category: None
    Event ID: 13568
    Date:  15/05/08
    Time:  8:23:22 AM
    User:  N/A
    Computer: DC1
    Description:
    The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR.

    ....................................................................

    After restart server "Application even log"

    Event Type: Warning
    Event Source: Ci
    Event Category: CI Service
    Event ID: 4149
    Date:  15/05/08
    Time:  8:29:33 AM
    User:  N/A
    Computer: DC1
    Description:
    Read of USN log for NTFS volume c: failed with error code 0xC000003E. 
    Volume will remain offline until the Indexing Service (cisvc) is restarted.

    For more information,
    see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    Event Type: Information
    Event Source: Ci
    Event Category: CI Service
    Event ID: 4137
    Date:  15/05/08
    Time:  8:29:33 AM
    User:  N/A
    Computer: DC1
    Description:
    CI has started for catalog c:\inetpub\catalog.wci.

    For more information,
    see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    Event Type: Warning
    Event Source: Ci
    Event Category: CI Service
    Event ID: 4149
    Date:  15/05/08
    Time:  8:29:33 AM
    User:  N/A
    Computer: DC1

     

    ----------------------------------------------------------------------

    Here is some NTFrs log

     

    <ThSupWaitThread:               5684:   505: S1: 04:00:01> Tongue Tied: ReplicaCs: Waiting
    <ThSupWaitThread:               5684:   533: S1: 04:00:01> Tongue Tied: ReplicaCs: normal wait
    <FrsDsFindComputer:             2712:  8796: S2: 04:00:01> Big SmileS: Computer FQDN is cn=dc1,ou=domain controllers,dc=abc,dc=com
    <FrsDsFindComputer:             2712:  8802: S2: 04:00:01> Big SmileS: Computer's dns name is dc1.abc.com
    <FrsDsFindComputer:             2712:  8816: S2: 04:00:01> Big SmileS: Settings reference is cn=ntds settings,cn=dc1,cn=servers,cn=default-first-site,cn=sites,cn=configuration,dc=abc,dc=com
    <FrsDsGetSysvolOutboundCxtions: 2712:  2869: S1: 04:00:01> Big SmileS: WARN - No sysvol outbound connections found for member cn=ntds settings,cn=dc1,cn=servers,cn=default-first-site,cn=sites,cn=configuration,dc=abc,dc=com!
    <FrsDsGetSysvolInboundCxtions:  2712:  2706: S1: 04:00:01> Big SmileS: WARN - No sysvol inbound connections found for object cn=ntds settings,cn=dc1,cn=servers,cn=default-first-site,cn=sites,cn=configuration,dc=abc,dc=com!
    <DbgPrintThreadIds:             3552:  1021: S2: 04:00:01> :H: Known thread IDs -
    <DbgPrintThreadIds:             3552:  1029: S2: 04:00:01> :H: First                : 2612
    <DbgPrintThreadIds:             3552:  1029: S2: 04:00:01> :H: Shutdown             : 2652
    <DbgPrintThreadIds:             3552:  1029: S2: 04:00:01> :H: FrsDs                : 2712
    <DbgPrintThreadIds:             3552:  1029: S2: 04:00:01> :H: SndCs                : 2740
    <DbgPrintThreadIds:             3552:  1029: S2: 04:00:01> :H: DelCs                : 2744
    <DbgPrintThreadIds:             3552:  1029: S2: 04:00:01> :H: OutLog               : 2748
    <DbgPrintThreadIds:             3552:  1029: S2: 04:00:01> :H: ReplicaCs            : 3552
    <DbgPrintThreadIds:             3552:  1029: S2: 04:00:01> :H: JRNL                 : 2756
    <DbgPrintThreadIds:             3552:  1029: S2: 04:00:01> :H: DBCs                 : 2768
    <DbgPrintThreadIds:             3552:  1029: S2: 04:00:01> :H: JrnlRead             : 3076
    <DbgPrintThreadIds:             3552:  1029: S2: 04:00:01> :H: COAccept             : 3080
    <DbgPrintThreadIds:             3552:  1029: S2: 04:00:01> :H: ChgOrdRetryCS        : 3132
    <DbgPrintThreadIds:             3552:  1029: S2: 04:00:01> :H: ThCs                 : 5684
    <FrsDsGetSysvolOutboundCxtions: 2712:  2869: S1: 08:15:01> Big SmileS: WARN - No sysvol outbound connections found for member cn=ntds settings,cn=dc1,cn=servers,cn=default-first-site,cn=sites,cn=configuration,dc=abc,dc=com!
    <FrsDsGetSysvolInboundCxtions:  2712:  2706: S1: 08:15:01> Big SmileS: WARN - No sysvol inbound connections found for object cn=ntds settings,cn=dc1,cn=servers,cn=default-first-site,cn=sites,cn=configuration,dc=abc,dc=com!
    <FrsDsFindComputer:             2712:  8796: S2: 08:20:01> Big SmileS: Computer FQDN is cn=dc1,ou=domain controllers,dc=abc,dc=com
    <FrsDsFindComputer:             2712:  8802: S2: 08:20:01> Big SmileS: Computer's dns name is dc1.abc.com

    Repeat and Repeat ..................

     

     

    No any DHCP error found in even log.

     

    What's the problem ?? Thank You!

     

     

    2008年5月16日 上午 03:21
  • Dear Customer,

     

    Thanks for posting!

     

    These two event logs can be due to various factors. Here are some general troubleshooting steps to resolve the issue:

    1. Run DFSUTIL /purgemupcache on the problem server and reboot.

    830676 Group Policy processing fails with Events 1058 and 1030 in Windows

    http://support.microsoft.com/?id=830676

     

    2. Make sure that the DFS client service is started on the faulty DC.

     

    3. Make sure that the DFS Server Service is started on the DC

     

    4. Ensure that Everyone has full control at the root drive.

     

    5. Make sure that SMB signing levels (Digitally sign server communication) match between DCs.  SMB signing policies write to the following registry keys:

     

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\param

    eters

    enablesecuritysignature [REG_DWORD] = 0x0

    requiresecuritysignature [REG_DWORD] = 0x0

     

    Note: If there is only 1 DC, you can temporarily disable SMB signing in the registry.  Go to:

     

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\lanmanserver\Parameters

     

    Set enablesecuritysignature to 0

    Set requiresecuritysignature to 0

     

    6. Make sure that all DCs have sysvol shared out and make sure that they contain the group policy objects that are failing to apply.  Run gpotool to look for problems.

     

    7. Make sure that "file and print sharing" as well as "client for MS networks" is enabled on the network adapter used for your Local Network

    connection.

     

    8. Make sure that the TCP/IP Netbios Helper service has not been stopped/disabled manually or by group policy.

     

    9. Apply the Secure DC template (securedc.inf) to the problem DC and then refresh group policy on the DC with gpupdate. For more information, see:

    816585 HOW TO: Apply Predefined Security Templates in Windows Server 2003

    http://support.microsoft.com/?id=816585

     

    10.  You can also refer to other possible causes reported by other Windows users at:

    http://www.eventid.net/display.asp?eventid=1058&source=Userenv

     

    If you have any concerns with the suggestions above, please feel free to post back. I will be happy to help!

     

    Sincerely,

    Tom Zhang, MCSE 2003

     

    2008年5月21日 上午 08:06
    版主
  • Dear Customer,

     

    I just wanted to say hi, and to see how things are going. I haven't heard back from you yet and I was wondering if there are any updates on the service request.

     

    Thanks.

     

    Sincerely,
    Tom Zhang

    2008年5月26日 上午 07:51
    版主