Re: DC Event warning 13508 - Help!

From: ptwilliams (ptw2001_at_hotmail.com)
Date: 01/23/05 

Date: Sun, 23 Jan 2005 17:56:22 -0000

Apologies for the delay, I missed your last post!

So you're having RPC errors? This is usually indicative of DNS problems.

Try this:

-- Load the DNS snap-in and navigate down to the _msdcs dub-domain. Check
all entries in here to see if there are any rogue/ out-of-date entries, i.e.
incorrect server names, site names that don't correspond to current sites,
etc. If there are any suspect entries, delete them.
-- Point both DCs at one DC for DNS name-resolution.
-- Ensure that the DHCP client service is set to automatically start and is
running on both DCs.
-- Restart the netlogon service
-- Go make a cup of coffee.
-- Change the DNS settings back to what they were once were.

-- Flush the NtFrs event log.
-- Restart the NtFrs service
-- Run aforementioned tests again.

If, after this you're still getting NtFrs problems I'd perform a
non-authorative restore on the DC that is showing these errors. Post back
if you want help with this, but this is probably not the issue.

Are both of these DCs in the same site? If not, are they separated by a
firewall or intelligent device that can filter/ block ports and traffic? 

-- 
Paul Williams
http://www.msresource.net
http://forums.msresource.net
"Gordon Pegue" <gpegue@cg-engrs.com> wrote in message 
news:1106236102.709622.145330@f14g2000cwb.googlegroups.com...
Been there, done that, no help with the end point mapper issue that
appears to be the cause of the errors.
Gordon
ptwilliams wrote:
> If you haven't already, have a look at this:
>  --
>
http://www.eventid.net/display.asp?eventid=13508&eventno=349&source=NtFrs&phase=1
>
>
> --
>
> Paul Williams
>
> http://www.msresource.net
> http://forums.msresource.net
>
>
> "Gordon Pegue" <gpegue@cg-engrs.com> wrote in message
> news:1106182568.389558.88010@c13g2000cwb.googlegroups.com...
> Anyone else have any ideas on this?
>
> Gordon
>
> Gordon Pegue wrote:
> > Finally, yes. Pretty good tool but I'm mystified by the results.
> > I ran all tests and they reported as passed EXCEPT for the
> FRSDiag.txt
> > report, included here:
> >
> > ------------------------------------------------------------
> > FRSDiag v1.7 on 1/17/2005 3:56:20 PM
> > .\Logs\MORRISON on 2005-01-17 at 3.56.20 PM
> > ------------------------------------------------------------
> >
> > Checking for minimum FRS version requirement ... passed
> > Checking for errors/warnings in ntfrsutl ds ... passed
> > Checking for Replica Set configuration triggers... passed
> > Checking for suspicious file Backlog size... passed
> > Checking Overall Disk Space and SYSVOL structure (note: integrity
is
> > not checked)... passed
> > Checking for suspicious inlog entries ... passed
> > Checking for suspicious outlog entries ... passed
> > Checking for appropriate staging area size ... passed
> > Checking for errors in debug logs ...
> > ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
> > 2028:   895: S0: 15:47:07> :SR: Cmd 014c4c90, CxtG 74e60f44, WS
> > ERROR_RETRY, To   HENDRIX.cg-engrs.cg-engrs.com Len:  (370)
[SndFail
> -
> > Send Penalty]
> > ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
> > 2028:   868: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
> > ERROR_RETRY, To   HENDRIX.cg-engrs.cg-engrs.com Len:  (370)
[SndFail
> -
> > rpc call]
> > ERROR on NtFrs_0005.log : "ERROR_RETRY" : <SndCsMain:
> > 2028:   895: S0: 15:52:07> :SR: Cmd 014ca608, CxtG 74e60f44, WS
> > ERROR_RETRY, To   HENDRIX.cg-engrs.cg-engrs.com Len:  (370)
[SndFail
> -
> > Send Penalty]
> > ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate
> that
> > DNS returns the IP address of the wrong computer. Check DNS records
> > being returned, Check if FRS is currently running on the target
> server.
> > Check if Ntfrs is registered with the End-Point-Mapper on target
> > server!)" : <SndCsMain:                     1684:   874: S0:
> 17:59:47>
> > ++ ERROR - EXCEPTION (000006d9) :  WStatus: EPT_S_NOT_REGISTERED
> > ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate
> that
> > DNS returns the IP address of the wrong computer. Check DNS records
> > being returned, Check if FRS is currently running on the target
> server.
> > Check if Ntfrs is registered with the End-Point-Mapper on target
> > server!)" : <SndCsMain:                     1684:   875: S0:
> 17:59:47>
> > :SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
> > HENDRIX.cg-engrs.cg-engrs.com Len:  (370) [SndFail - rpc exception]
> > ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate
> that
> > DNS returns the IP address of the wrong computer. Check DNS records
> > being returned, Check if FRS is currently running on the target
> server.
> > Check if Ntfrs is registered with the End-Point-Mapper on target
> > server!)" : <SndCsMain:                     1684:   895: S0:
> 17:59:47>
> > :SR: Cmd 014ae730, CxtG 42abb757, WS EPT_S_NOT_REGISTERED, To
> > HENDRIX.cg-engrs.cg-engrs.com Len:  (370) [SndFail - Send Penalty]
> >
> > Found 24404 ERROR_RETRY error(s)! Latest ones (up to 3) listed
above
> > Found 3 EPT_S_NOT_REGISTERED error(s)! Latest ones (up to 3) listed
> > above
> >
> > ......... failed with 24407 error entries
> > Checking NtFrs Service (and dependent services) state...passed
> > Checking NtFrs related Registry Keys for possible problems...passed
> > Checking Repadmin Showreps for errors...passed
> >
> >
> > So I attempted to find out more about the RPC End Point Mapper and
> came
> > up empty.
> >
> > Any more ideas on how to run this down?
> >
> > Thanks
> > Gordon
> >
> > Denis Wong @ Hong Kong wrote:
> > >
> > > Have you tried to use the FRSDiag to troubleshoot?
> > >
> > >
> > > br,
> > > Denis
> > >
> > > "Gordon" wrote:
> > >
> > > > Greetings-
> > > >
> > > > I have a rather simple, single domain with two DC's running
fully
> > > > patched Windows 2000 Server and 3 other member servers, 2 of
> which
> > are
> > > > running fully patched Windows 2000 Server and the other fully
> > patched
> > > > Windows 2003 server (my exchange 2003 host).
> > > >
> > > > One DC, shown as DC1 below in the event log text, has exactly
one
> > 13508
> > > > warning per day in the event log.
> > > >
> > > > I've never seen a corresponding 13509 or 1265 event on either
DC.
> > > >
> > > > I've run the full series of tests using DcDiag and NetDiag and
no
> > > > errors are reported in the resulting logs.
> > > >
> > > > The SRV records appear to be correctly set on both DC's DNS.
> > > >
> > > > The permissions on the Sysvol share are set correctly.
> > > >
> > > > Time syncing is from DC1 and is functioning properly.
> > > >
> > > > This one has me a bit baffled as I do not know what is causing
> the
> > > > event nor do I know if it is critical problem that needs to be
> > > > addressed or if it is something that is more of an annoyance
> event
> > > > warning than anything else.
> > > >
> > > >
> > > > Any thoughts, suggestions, troubleshooting ideas appreciated.
> > > > Thx
> > > > Gordon Pegue
> > > >
> > > >
> > > >
> > > >
> > > > Event Type: Warning
> > > > Event Source: NtFrs
> > > > Event Category: None
> > > > Event ID: 13508
> > > > Date: 1/8/2005
> > > > Time: 5:57:25 AM
> > > > User: N/A
> > > > Computer: DC1
> > > > Description:
> > > > The File Replication Service is having trouble enabling
> replication
> > > > from DC2 to DC1 for c:\winnt\sysvol\domain using the DNS name
> > > > DC2.cg-engrs.cg-engrs.com.
> > > >
> > > > FRS will keep retrying.
> > > >
> > > > Following are some of the reasons you would see this warning.
> > > >
> > > > [1] FRS can not correctly resolve the DNS name
> > > > DC2.cg-engrs.cg-engrs.com from this computer.
> > > > [2] FRS is not running on DC2.cg-engrs.cg-engrs.com.
> > > > [3] The topology information in the Active Directory for this
> > replica
> > > > has not yet replicated to all the Domain Controllers.
> > > >
> > > > This event log message will appear once per connection.
> > > > After the problem is fixed you will see another event log
message
> > > > indicating that the connection has been established.
> > > >
> > > >