| Event Id | 13515 |
| Source | NtFrs |
| Description | The File Replication Service may be preventing the computer NEMESIS from becoming a domain controller while the system volume is being initialized and then shared as SYSVOL. Type net share to check for the SYSVOL share. The File Replication Service has stopped preventing the computer from becoming a domain controller once the SYSVOL share appears. The initialization of the system volume can take some time. The time is dependent on the amount of data in the system volume. The initialization of the system volume can be bypassed by first typing regedt32 and setting the value of SysvolReady to 1 and then restarting the Netlogon service. WARNING - BYPASSING THE SYSTEM VOLUME INITIALIZATION IS NOT RECOMMENDED. Applications may fail in unexpected ways. The value SysvolReady is located by clicking on HKEY_LOCAL_MACHINE and then clicking on System, CurrentControlSet, Services, Netlogon, and Parameters. T2001-03-27,22:47:18,127.0.0.1,5,4,EvntSLog:214520: [AUF] Tue Mar 27 22:47:17 2001: KANT/Security (578) - Privileged object operation: Object Server: Security Object Handle: 4294967295 Process ID: 1656 Primary User Name: DOMPDC$ Primary Domain:CORPDOM Primary Logon ID: (0x0,0x3E7) Client User Name: adrian Client Domain: CORPDOM Client Logon ID: (0x0,0x5ECEE65) Privileges: SeIncreaseBasePriorityPrivilege |
| Event Information | CAUSE: Windows 2000 does not support the SYSVOL folder on a mounted volume. The File Replication service takes the full path of the SYSVOL folder and opens a journal on that volume to track changes. Also, a number of functions internal to the File Replication service use the volume handle as an argument. With a mounted volume, the SYSVOL folder and the data it contains actually resides on another volume entirely; the journal cannot track changes and the internal File Replication service functions mentioned earlier do not work. RESOLUTION: To restore the File Replication service to working order: Demote the domain controller: Start Registry Editor (Regedt32.exe). Locate the following key in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters On the Edit menu, click Add Value, and then add the following registry value: Value Name: SysvolReady Data Type: REG_DWORD Value: 1 Quit Registry Editor. Stop and restart the Netlogon service. The SYSVOL share should now be created. You can demote the domain controller successfully by using Dcpromo. Use the Disk Management snap-in to assign a drive letter to the mounted volume. Run Dcpromo and place the NTDS and SYSVOL folders on the new drive. |
| Reference Links | Event ID 13515 and 7071 on Domain Controller After Running Dcpromo |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.