#define EVENT_FRS_IN_ERROR_STATE 0xC00034F3L
MessageId: EVENT_FRS_IN_ERROR_STATE MessageText: The File Replication Service is in an error state. Files will not replicate to or from one or all of the replica sets on his computer until the following recovery steps are performed: %n %n Recovery Steps: %n %n [1] The error state may clear itself if you stop and restart the FRS service. This can be done by performing the following in a command window: %n %n net stop ntfrs %n net start ntfrs %n %nIf this fails to clear up the problem then proceed as follows. %n %n [2] For Active Directory Domain Controllers that DO NOT host any DFS alternates or other replica sets with replication enabled: %n %nIf there is at least one other Domain Controller in this domain then restore the "system state" of this DC from backup (using ntbackup or other backup-restore utility) and make it non-authoritative. %n %nIf there are NO other Domain Controllers in this domain then restore the "system state" of this DC from backup (using ntbackup or other backup-restore utility) and choose the Advanced option which marks the sysvols as primary. %n %nIf there are other Domain Controllers in this domain but ALL of them have this event log message then restore one of them as primary (data files from primary will replicate everywhere) and the others as non-authoritative. %n %n %n [3] For Active Directory Domain Controllers that host DFS alternates or other replica sets with replication enabled: %n %n (3-a) If the Dfs alternates on this DC do not have any other replication partners then copy the data under that Dfs share to a safe location. %n (3-b) If this server is the only Active Directory Domain Controller for this domain then, before going to (3-c), make sure this server does not have any inbound or outbound connections to other servers that were formerly Domain Controllers for this domain but are now off the net (and will never be coming back online) or have been fresh installed without being demoted. To delete connections use the Sites and Services snapin and look for %nSites->NAME_OF_SITE->Servers->NAME_OF_SERVER->NTDS Settings->CONNECTIONS. %n (3-c) Restore the "system state" of this DC from backup (using ntbackup or other backup-restore utility) and make it non-authoritative. %n (3-d) Copy the data from step (3-a) above to the original location after the sysvol share is published. %n %n %n [4] For other Windows 2000 servers: %n %n (4-a) If any of the DFS alternates or other replica sets hosted by this server do not have any other replication partners then copy the data under its share or replica tree root to a safe location. %n (4-b) net stop ntfrs %n (4-c) rd /s /q %1 %n (4-d) net start ntfrs %n (4-e) Copy the data from step (4-a) above to the original location after the service has initialized (5 minutes is a safe waiting time). %n %nNote: If this error message is in the eventlog of all the members of a particular replica set then perform steps (4-a) and (4-e) above on only one of the members.
Lanman Server Events (2000 - 2999) 2000-2499 are generated by the server driver (kernel mode) 2500-2999 are generated by the server service (user mode) Server driver events, issued from kernel mode. Values are 32 bit values laid out as follows: 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 +---+-+-+-----------------------+-------------------------------+ |Sev|C|R| Facility | Code | +---+-+-+-----------------------+-------------------------------+ where Sev - is the severity code 00 - Success 01 - Informational 10 - Warning 11 - Error C - is the Customer code flag R - is a reserved bit Facility - is the facility code Code - is the facility's status code