You receive the following error after cloning a Windows 2008 DC.
Event ID: 13559
The File Replication Service has detected that the replica root path has changed from “d:\windows\sysvol\domain” to “d:\windows\sysvol\domain”. If this is an intentional move then a file with the name NTFRS_CMD_FILE_MOVE_ROOT needs to be created under the new root path.
This was detected for the following replica set:
“DOMAIN SYSTEM VOLUME (SYSVOL SHARE)”
Changing the replica root path is a two step process which is triggered by the creation of the NTFRS_CMD_FILE_MOVE_ROOT file.
 At the first poll which will occur in 60 minutes this computer will be deleted from the replica set.
 At the poll following the deletion this computer will be re-added to the replica set with the new root path. This re-addition will trigger a full tree sync for the replica set. At the end of the sync all the files will be at the new location. The files may or may not be deleted from the old location depending on whether they are needed or not.
The Volume Serial Number of the drive letter specified in the Event ID has changed (D: in this case). The File Replication Service saves and compares the Volume Serial Number and other disk information on each startup. Changing the Volume Serial Number to the original value will not resolve this problem.
This most likely occurred because you have cloned, backed up and restored or otherwise changed the drive that holds the SYSVOL information.
Providing you have at least one other DC for this domain available and the problem DC does not hold any FSMO roles for the domain you can follow these steps to resolve this issue:
1) Backup/Copy the location specified (d:\windows\sysvol\domain in this case) to a folder in the same partition
- This will keep the permissions intact and keep copies of the files just in case there is an issue.
2) Create a file called NTFRS_CMD_FILE_MOVE_ROOT in the location specific
- d:\windows\sysvol\domain in this case
3) Restart the File Replication Service.
4) Check the Event Log for the following event
Event ID: 13560
The File Replication Service is deleting this computer from the replica set “DOMAIN SYSTEM VOLUME (SYSVOL SHARE)” as an attempt to recover from the error state,
Error status = FrsErrorMismatchedVolumeSerialNumber
At the next poll, which will occur in 5 minutes, this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.
- Sometimes Error status = FrsErrorMismatchedReplicaRootObjectId is given.
5) Wait 5-10 minutes or more then check the event log again for the following additional events
Event ID: 13520
The File Replication Service moved the preexisting files in d:\windows\sysvol\domain to d:\windows\sysvol\domain\NtFrs_PreExisting___See_EventLog.
The File Replication Service may delete the files in d:\windows\sysvol\domain\NtFrs_PreExisting___See_EventLog at any time. Files can be saved from deletion by copying them out of d:\windows\sysvol\domain\NtFrs_PreExisting___See_EventLog. Copying the files into d:\windows\sysvol\domain may lead to name conflicts if the files already exist on some other replicating partner.
In some cases, the File Replication Service may copy a file from d:\windows\sysvol\domain\NtFrs_PreExisting___See_EventLog into d:\windows\sysvol\domain instead of replicating the file from some other replicating partner.
Space can be recovered at any time by deleting the files in d:\windows\sysvol\domain\NtFrs_PreExisting___See_EventLog.
Event ID: 13553
The File Replication Service successfully added this computer to the following replica set:
“DOMAIN SYSTEM VOLUME (SYSVOL SHARE)”
Information related to this event is shown below:
Computer DNS name is “DC01.domain.local”
Replica set member name is “DC01”
Replica set root path is “d:\windows\sysvol\domain”
Replica staging directory path is “d:\windows\sysvol\staging\domain”
Replica working directory path is “c:\windows\ntfrs\jet”
Event ID: 13516
The File Replication Service is no longer preventing the computer DC01 from becoming a domain controller. The system volume has been successfully initialized and the Netlogon service has been notified that the system volume is now ready to be shared as SYSVOL.
Type “net share” to check for the SYSVOL share.
6) Event 13516 indicates you have successfully re-established replication of the SYSVOL.
- You can safely delete the NtFrs_PreExisting___See_EventLog folder specified in event 13553.
7) You should keep your manual backup copy for a few days just in case there were files that are needed.
To save replication time you can mark the SYSVOL as a non authoritative restore and restart the NtFrs service. You do this by editing the BurFlags registry setting of the NtFrs Services key. Read this for more information:
If this is your only DC you need to mark the SYSVOL as authoritative for the domain by editing the BurFlags registry setting of the NtFrs Services key. Read this for more information:
Posted in: Server