Skip to main content

DC Authoritative (D4) Restore for FRS

DISCLAIMER: The information in this guide is provided "as is" without any guarantee of completeness, accuracy, timeliness, or of the results obtained from the use of this information. The author assumes no responsibility for any errors or omissions in the content. It is meant for general information purposes only and should not be used as a substitute for professional advice. The author is not responsible for any damages caused by the use of this information. By using this guide, you agree to hold the author harmless from any and all claims, damages, or expenses that may arise from your use of the information.

Introduction

This section contains excerpts from Microsoft:

Use authoritative restores only as a final option, such as if there are directory collisions.

For example, you may require an authoritative restore if you must recover an FRS replica set where replication has completely stopped and requires a rebuild from scratch.

FRS is a multi-threaded, multi-master replication engine that Windows Server domain controllers use to replicate system policies and logon scripts. You can also use FRS to replicate content between Windows Servers that host the same fault-tolerant Distributed File System (DFS) roots or child node replicas. In Windows Server 2008 R2 and newer, FRS can only be used to replicate the Domain SYSVOL replica set.

When you deploy Windows-based domain controllers or member servers that use FRS to replicate files in SYSVOL or DFS shares, you may have to restore or reinitialize individual members of a replica set if replication has stopped or is inconsistent. In some scenarios, you may have to rebuild the whole replica set from scratch.

System state backups of Windows member servers and domain controllers do not include the FRS database that maintains a mapping of files that are held in local FRS trees and a master list of FRS files.

The global BurFlags registry key contains REG_DWORD values, and is located in the following location in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup

The most common values for the BurFlags registry key are:

  • D2, also known as a nonauthoritative mode restore.
  • D4, also known as an authoritative mode restore.

You can also perform BurFlags restores at the same time as you restore data from backup or from any other known good source, and then restart the service.

Requirements

The following list of requirements must be met before you perform an authoritative FRS restore:

  • Domain Controller environment is using FRS.

  • The FRS service must be disabled on all downstream partners (direct and transitive) for the reinitialized replica sets before you restart the FRS service when the authoritative restore has been configured to occur.

  • Events 13553 and 13516 have been logged in the FRS event log. These events indicate that the membership to the replica set has been established on the computer that is configured for the authoritative restore.

  • The computer configured for the authoritative restore is configured to be authoritative for all the data that you want to replicate to replica set members. It isn't the case if you are performing a join on an empty directory.

  • All other partners in the replica set must be reinitialized with a nonauthoritative restore.

Instructions

To complete an authoritative restore, stop the FRS service, configure the BurFlags registry key, and then restart the FRS service. To do so:

  1. Select Start, and then select Run.

  2. In the Open box, type cmd and then press ENTER.

  3. In the Command box, type net stop ntfrs.

  4. Select Start, and then select Run.

  5. In the Open box, type regedit and then press ENTER.

  6. Locate the following subkey in the registry:
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup

  7. In the right pane, double select BurFlags.

  8. In the Edit DWORD Value dialog box, type D4 and then select OK.

  9. Quit Registry Editor, and then switch to the Command box.

  10. In the Command box, type net start ntfrs.

  11. Quit the Command box.

When the FRS service is restarted, the following actions occur:

  • The value for the BurFlags registry key is set back to 0.
  • An event 13566 is logged to signal that an authoritative restore is started.
  • Files in the reinitialized FRS replicated directories remain unchanged and become authoritative on direct replication. Additionally, the files become indirect replication partners through transitive replication.
  • The FRS database is rebuilt based on current file inventory.
  • When the process is complete, an event 13516 is logged to signal that FRS is operational. If the event isn't logged, there's a problem with the FRS configuration.

Sources

 

KB Change/Issue Log

yyyy/mm/dd - Title

Issue

N/A

Solution

N/A

KB Meta

Page Includes @9#bkmrk-callout-danger-NoResponsibilityDisclaimer-5wod5ufe
Back to top