July 27, 2009

Fix for File Replication System (NTFRS) replication problems (Event ID 13549)

Filed under: Active Directory — Rahul Patel @ 5:09 pm

This fix worked for me in resolving an issue where a additional domain controller was in a death cycle of starting/stopping/restarting the FRS service every few minutes.


If, after you run DCPROMO to add a domain controller to the existing domain, after reboot, you run into a problem where the NETLOGON and SYSVOL shares are not being created and you check the File Replication Service logs in the Event log to find the following error messages:

(Event ID 13549)
The File Replication Service is unable to replicate from a partner computer because the event time associated with the file to be replicated is too far into the future. It is 30 minutes greater than the current time. This can happen if the system time on the partner computer was set incorrectly when the file was created or updated. To preserve the integrity of the replica set this file update will not be performed or propagated further.

The file name is: “[YOUR_PROBLEM_FILE_HERE]”
The connection to the partner computer is:


Make sure and keep copies of all the folders and files.

Take these actions to resolve your problem:

On all Active Directory registered domain controllers:

1. Stop NETLOGON Service
2. Stop File Replication Service (NTFRS)

On the PDC Emulator

1. Rename all files in the %systemroot%\ntfrs folder and subfolders (change their extension to .old).
2. Give an unlisted account full control of the directory %systemroot%\SYSVOL folder and reset permissions on all child objects.
3. Change the registry key:
HKLM\System\CurrentControlSet\Services\ntfrs\paramaters\Backup/Restore\Process at Startup\BurFlags (REG_DWORD) = D4
(The default on this is 0)
4. Start the NETLOGON Service
5. Start the NTFRS Service

On all non-PDC emulators:

1. Change the registry key:
HKLM\System\CurrentControlSet\Services\ntfrs\paramaters\Backup/Restore\Process at Startup\BurFlags (REG_DWORD) = D2
2. Start the NETLOGON Service
3. Start the File Replication Service (NTFRS)

At this point, the system in question should have recreated the SYSVOL share and the NETLOGON share. Check this by running ‘net share’ from a command prompt. You should also see the Group Policy Objects listed in the SYSVOL directory as:



There may be more directories listed here, but these are the Default Domain Policy and the Default Domain Controllers Policy that are installed by default when the Active Directory is created. If these are being replicated, then file replication is functioning.



  1. […] Fix for File Replication System (NTFRS) replication problems (Event ID 13549) July 2009 Leave a Comment LikeBe the first to like this post. […]

    Pingback by 2010 in review « RahulPatel–twikies… — January 2, 2011 @ 2:21 pm | Reply

  2. Thank you Thank you Thank you! I had the same problem and it drove me bonkers! But now it is fixed thanks to this solution! Well done! Greetings from The Netherlands!

    Comment by Walter Beelen — December 20, 2011 @ 3:34 pm | Reply


    Comment by antonio — October 12, 2013 @ 6:46 am | Reply

  4. I really like reading through an article that will make men and women think.

    Also, thanks for permitting me to comment!

    Comment by chat gratis — February 21, 2014 @ 6:46 am | Reply

RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

Blog at WordPress.com.

%d bloggers like this: