I was getting this in my SYSVOL share on both of my servers after I had JRNL_WRAP_ERROR on both of my Domain Controllers. I tried to resolv the JRNL_WRAP_ERROR on my servers by setting the BurFlags to D2 on both servers. That was not a good idea.
The solution to the problem was to:

On both servers do step 1 – 7

1. Click Start, and then click Run.
2. In the Open box, type cmd and then press ENTER.
3. In the Command box, type net stop ntfrs.
4. Click Start, and then click Run.
5. In the Open box, type regedit and then press ENTER.
6. Locate the following subkey in the registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\NtFrs\Parameters\Backup/Restore\Process at Startup
7. In the right pane, double-click BurFlags.
8. In the Edit DWORD Value dialog box, type D2 on one of the servers and on the other server type D4 then click OK.
9. Quit Registry Editor.
10. On the server where you edited the BurFlags DWORD to D4 copy the folders in the folder NtFrs_PreExisting___See_EventLog to C:\WINDOWS\SYSVOL\sysvol\yourdomain.local
11. In the Command box on the server where you set the DWORD to D4, type net start ntfrs. When the service has started go to your other server and type net start ntfrs.
11. Quit the Command box.
12. Check the eventlog for messages.

This entry was posted in Active Directory. Bookmark the permalink.

5 Responses to NtFrs_PreExisting___See_EventLog

  1. Stanislav says:

    It helped me. The cause of my problem were operations initiated by file “NTFRS_CMD_FILE_MOVE_ROOT”.

  2. Terry says:

    Thank you very very much this really helped and got my server backup a lot quicker than trying to do a AD restore.

  3. Steve B says:

    You sir, just saved my bacon. I can’t tell you how much this helped me after I added a new DC to a domain and it wouldn’t replicate at all.

  4. Rob B. says:

    This might be my favorite post ever. In my case, I had introduced a new Windows 2012 R2 Essentials machine into an existing, single server, Windows 2008 domain. Like you, I had journal_wrap error messages I tried to fix but somehow that left me with the NTFRS_preexisting folder and a completely broken domain. I never had replication of the sysvol directory working to the Windows 2012 R2 Essentials machine, so I only had the NTFRS_preexisting folder on the Windows 2008 machine. I set that machine with D4, the Windows 2012 box with D2…and voila my domain was back. Not only that, my replication to the new server worked like a charm too. I can’t thank you enough for this post.

  5. Darryl E says:

    Many thanks for this :)
    Fixed our problem caused by the use of “NTFRS_CMD_FILE_MOVE_ROOT”
    Just as a side note, we only had the one server so used the D4 setting, copied the files as directed, restart NTFRS, the NtFrs_PreExisting___See_EventLog folder was removed and domain was back in action.

Leave a Reply

Your email address will not be published. Required fields are marked *