I set aside an hour a week to work with our domain controllers. During this time I run health checks, review logs, and review event viewer entries. I have been looking for a way to automate a health check script using powershell, but for the time being I am sticking with the normal commands. I ran Dcdiag.exe /v this morning to review the overall health of the domain controller (DC) and everything was normal except one thing. There was an error in the FrsEvent which is the File Replication Service.
I have been hearing of issues of group policy replication issues going around, and until now, the domain controllers have been reporting back as healthy, but now I have something to work with. I ran the Dcdiag.exe /v command on our second domain controller and everything came back healthy.
At this point I did a search for 0x800034C4. I wasn’t able to find much specific about the error, but went to check the services status on both domain controllers to make sure the services were started that needed to be. I usually do this by sorting to show automatic startup type and then check to make sure all of those are started. All the services looked fine on both domain controllers.
Next I started going through the actual reasons why it may be showing this error. The first being that is not able to resolve the domain controller’s DNS name. I pinged the DC1 from DC and it resolved the DNS name just fine.
Next was FRS is not running on DC1. I verified that the File Replication Service was indeed running on DC1, but do I need to restart the service for some reason, will this have any impact? After reading a little bit, it did not sound like it would affect anything, I restarted the File Replication Service on both domain controllers.
Next I went into the File Replication Service Event Log in Event Viewer on both Domain Controllers, and DC looked fine, while DC1 had a lot of errors.
I followed the instructions for creating a new DWORD Value for “Enable Journal Wrap Automatic Restore” and restarted the Ntfrs service on the problem DC1.
After restarting the service, I went back into the Event Viewer to watch for any new events and this appeared.
After 5 minutes the following entries showed up in the event viewer.
I changed back the registry key to 0, from 1, and will continue to keep an eye on this for a few days.