JRNL_WRAP_ERROR – Event 13568, Ntfrs – Server 2008

Getting a JRNL_WRAP error in your event logs is never a pretty site. Losing all you policies and scripts that was in your sysvol folder after fixing the JRNL_WRAP is even worst. This happens when you do the below fixes in an environment where you have only one DC. If you have more than one DC you don’t need to worry as the server that you are applying the fix to will pull the sysvol data from one of the other DC’s.

Ok, so there are two ways of fixing a JRNL_ WRAP error in Server 2008 (Remember to make a system state backup before you do this).

 

  1. Follow the instructions that is described in the Server 2008 event viewer – This does an auto restore. Unfortunately this process does not always work, we have had it a couple of times where we sit and wait for this auto restore process to finish but it never happens.

2.   Use the burflags method to do an authoritative or nonauthoritative restore

a. In Command prompt, type ‘net stop ntfrs’.
b. Open the registry (Click start, In the Run box, type regedit and press ENTER).
c. Locate the following subkey in the registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\NtFrs\Parameters\Backup/Restore\Process at Startup
d. In the right pane, double-click BurFlags.
e. In the Edit DWORD Value dialog box, type D2 and then click OK (This does a nonauthoritative restore, Use ‘D4’ for an authoritative restore).
f. Quit Registry Editor, and then switch to the Command Prompt and type ‘net start ntfrs’..

As soon as the FRS service restarts the following happens:
• The BurFlags registry key returns to 0.
• Content in the Sysvol folder are moved to the Pre-existing folder.
• FRS database is rebuilt.
• The server performs an initial join of the replica set from a partner.
• The server performs a full replication of the replica sets.

Obviously  you would like to make sure that you don’t lose your sysvol data (Policies and scripts) – This happens when you run the above fixes in an environment where you only have one DC.

 

So to prevent this do the following:

 

  1. Run a system state backup before you make any changes.
  2. As soon as you apply the auto restore fix (Option 1 on the above fixes), you will see that it creates a ‘Ntfrs_PreExisting’ folder in the sysvol folder. All the policies and scripts that you had will be moved into this folder. Make a backup of these files before they are removed by the system (See below screen shot for details). You won’t be able to copy these files out before they are moved to the Ntfrs_PreExisting folder as the system locks them.
  3. Once the auto restore process completes – Copy the sysvol files that you backed up to the new sysvol folder that will automatically be shares once the process is complete.

 

Should the auto restore process not work, run the burflags fix (Option 2 above) and copy the sysvol files that you backed up to the new sysvol that will be shared after a successful fix.

You will know that the JRNL_WRAP error is fixed if you get the below entry in the event viewer.