Troubleshooting and Correcting File Replication Sharing Violations; Expired Credentials Bug Fix; a SCSI Slowdown Fix; and more

The File Replication Service (FRS) can't propagate files that are open while the propagation code is running. If you notice that files in the SYSVOL directory, or files you host with DFS, aren't being replicated, a user or an application such as a virus scanner, a disk optimization tool, or a user profile likely has the files open for use. When the system encounters sharing violations in either of these directories, it doesn't post an error message in the FRS event log stating that the file or files to be replicated were open and couldn't be propagated, so you have no information about what went wrong. For more information about this problem, see the Microsoft article "File Replication Service Does Not Log Errors on Sharing Violations" (http://support.microsoft.com/?kbid=815473). Troubleshooting such replication problems can be tedious; you need to identify the problem file and determine which user or application has the file open. The new "Windows 2000 Server Resource Kit" Sonar utility (which you can download at http://www.microsoft.com/windows2000/techinfo/reskit/tools/new/sonar-o.asp) can help you troubleshoot file-sharing violations and other replication problems. Sonar is a command-line tool that monitors key replication statistics, including traffic levels, backlogs, and free space and provides feedback about what's not working. You can install and run Sonar on any Win2K server that's a member of the replication infrastructure. You can also install Sonar on a Win2K Professional system, but it requires two steps: First copy the ntfrsapi.dll Win2K server file to the Win2k Pro system, then install the Sonar tool. Sonar documentation states that when the utility detects a sharing violation during replication, it reports the violation in the Server column as a nonzero entry.

Microsoft Product Support Services (PSS) has an FRS update that provides feedback about sharing violations that compromise the replication cycle. Released on June 27, the update contains new versions of five FRS components, including ntfrs.exe, ntfrsapi.dll, ntfrsprf.dll, ntfrsupg.exe, and ntfrsutl.exe. After you install the FRS update, you can configure when FRS logs file-sharing violations with event ID 13573 in the event log. See the Microsoft article "FRS Encounters 'ERROR_SHARING_VIOLATION' Errors When It Tries to Replicate Data That Is Still in Use (http://support.microsoft.com/?kbid=822300) for additional information about techniques you can use in conjunction with the update to report on and reduce replication-based file-sharing errors. On a related note, the Microsoft article "How to Troubleshoot an 'Internal Error' Error Message During the Replication Phase of Dcpromo" (http://support.microsoft.com/?kbid=265090) describes how to enable logging for a variety of FRS errors by modifying the value entries in the HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNTDSDiagnostics FRS registry subkey.

Expired Credentials Bug Fix
When the local system on which you log on can't contact a domain controller (DC), the local system logs you on with cached credentials. When you log on interactively or through a VPN connection by using cached credentials, the local system doesn't verify the authentication criteria until you try to connect to a network resource in the domain. Win2K has a bug that appears when the cached credentials are no longer valid (e.g., your account has been disabled or locked out) or when the cached credentials on the local system have been deleted, for example with a custom registry or Group Policy setting. If, after logging on with invalid credentials, you connect to a network resource in this scenario, a Win2K bug causes the system to prompt you repeatedly for your username and password, responding each time with the message “The system cannot log you on now because the domain is not available.” Microsoft released a bug fix for this problem on July 15. The patch contains updates to 24 key files, including Kerberos, the Local Security Authority (LSA), and the SAM components. This update is available only from PSS. For details about all the files in this patch, see the Microsoft article "The System Cannot Log You On Now Because the Domain Is Not Available" (http://support.microsoft.com/?kbid=824302).

SCSI Slowdown Fix

The disk class driver monitors errors on SCSI hard disks. When the error count reaches a predefined threshold, the system responds by issuing only one I/O request at a time, instead of sending overlapping I/O requests. The Microsoft article "Performance Decreases After Several Disk Errors" (http://support.microsoft.com/?kbid=324007) states that you can work around the SCSI slowdown by restarting the system. To permanently solve the problem, call PSS and ask for the July 1 version of the Classpnp.sys SCSI miniport driver. The updated driver delays the restart sequence until the replacement disk is online and can be properly recognized.

Hot-Swap Disk Problem

If you cycle power on a system while you're replacing a hot-swappable disk, a bug in the ATAPI driver might cause the system to ignore the replacement disk. If this happens, you can force the system to recognize the disk by using Device Manager’s Scan for New Hardware feature. If you're having a spate of problems with hot-swapping disks, you might want to install the bug fix, a new version of Atapi.sys with a file release date of June 11.

Low Memory System Hang

A bug in the Win2K Messenger service might cause a system to hang during shutdown. In low memory conditions, the Messenger service can get stuck in an infinite loop. PSS has a fix, a new version of msgsvc.dll with a file release date of June 23 and a new version of spmsg.dll with a file release date of March 14. In the Knowledge Base, this bug is flagged as a pre-Service Pack 4 (SP4) fix, but I didn’t verify whether the Messenger service fix is included in SP4. Check with PSS and cite the Microsoft article "Computer Stops Responding During Shut Down, and You Receive a 'Disconnecting Network' Error Message" (http://support.microsoft.com/?kbid=823344).

The File Replication Service (FRS) can't propagate files that are open while the propagation code is running. If you notice that files in the SYSVOL directory, or files you host with DFS, aren't being replicated, a user or an application such as a virus scanner, a disk optimization tool, or a user profile likely has the files open for use. When the system encounters sharing violations in either of these directories, it doesn't post an error message in the FRS event log stating that the file or files to be replicated were open and couldn't be propagated, so you have no information about what went wrong. For more information about this problem, see the Microsoft article "File Replication Service Does Not Log Errors on Sharing Violations" (http://support.microsoft.com/?kbid=815473). Troubleshooting such replication problems can be tedious; you need to identify the problem file and determine which user or application has the file open. The new "Windows 2000 Server Resource Kit" Sonar utility (which you can download at http://www.microsoft.com/windows2000/techinfo/reskit/tools/new/sonar-o.asp) can help you troubleshoot file-sharing violations and other replication problems. Sonar is a command-line tool that monitors key replication statistics, including traffic levels, backlogs, and free space and provides feedback about what's not working. You can install and run Sonar on any Win2K server that's a member of the replication infrastructure. You can also install Sonar on a Win2K Professional system, but it requires two steps: First copy the ntfrsapi.dll Win2K server file to the Win2k Pro system, then install the Sonar tool. Sonar documentation states that when the utility detects a sharing violation during replication, it reports the violation in the Server column as a nonzero entry.

Microsoft Product Support Services (PSS) has an FRS update that provides feedback about sharing violations that compromise the replication cycle. Released on June 27, the update contains new versions of five FRS components, including ntfrs.exe, ntfrsapi.dll, ntfrsprf.dll, ntfrsupg.exe, and ntfrsutl.exe. After you install the FRS update, you can configure when FRS logs file-sharing violations with event ID 13573 in the event log. See the Microsoft article "FRS Encounters 'ERROR_SHARING_VIOLATION' Errors When It Tries to Replicate Data That Is Still in Use (http://support.microsoft.com/?kbid=822300) for additional information about techniques you can use in conjunction with the update to report on and reduce replication-based file-sharing errors. On a related note, the Microsoft article "How to Troubleshoot an 'Internal Error' Error Message During the Replication Phase of Dcpromo" (http://support.microsoft.com/?kbid=265090) describes how to enable logging for a variety of FRS errors by modifying the value entries in the HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNTDSDiagnostics FRS registry subkey.

Expired Credentials Bug Fix
When the local system on which you log on can't contact a domain controller (DC), the local system logs you on with cached credentials. When you log on interactively or through a VPN connection by using cached credentials, the local system doesn't verify the authentication criteria until you try to connect to a network resource in the domain. Win2K has a bug that appears when the cached credentials are no longer valid (e.g., your account has been disabled or locked out) or when the cached credentials on the local system have been deleted, for example with a custom registry or Group Policy setting. If, after logging on with invalid credentials, you connect to a network resource in this scenario, a Win2K bug causes the system to prompt you repeatedly for your username and password, responding each time with the message “The system cannot log you on now because the domain is not available.” Microsoft released a bug fix for this problem on July 15. The patch contains updates to 24 key files, including Kerberos, the Local Security Authority (LSA), and the SAM components. This update is available only from PSS. For details about all the files in this patch, see the Microsoft article "The System Cannot Log You On Now Because the Domain Is Not Available" (http://support.microsoft.com/?kbid=824302).

SCSI Slowdown Fix

The disk class driver monitors errors on SCSI hard disks. When the error count reaches a predefined threshold, the system responds by issuing only one I/O request at a time, instead of sending overlapping I/O requests. The Microsoft article "Performance Decreases After Several Disk Errors" (http://support.microsoft.com/?kbid=324007) states that you can work around the SCSI slowdown by restarting the system. To permanently solve the problem, call PSS and ask for the July 1 version of the Classpnp.sys SCSI miniport driver. The updated driver delays the restart sequence until the replacement disk is online and can be properly recognized.

Hot-Swap Disk Problem

If you cycle power on a system while you're replacing a hot-swappable disk, a bug in the ATAPI driver might cause the system to ignore the replacement disk. If this happens, you can force the system to recognize the disk by using Device Manager’s Scan for New Hardware feature. If you're having a spate of problems with hot-swapping disks, you might want to install the bug fix, a new version of Atapi.sys with a file release date of June 11.

Low Memory System Hang

A bug in the Win2K Messenger service might cause a system to hang during shutdown. In low memory conditions, the Messenger service can get stuck in an infinite loop. PSS has a fix, a new version of msgsvc.dll with a file release date of June 23 and a new version of spmsg.dll with a file release date of March 14. In the Knowledge Base, this bug is flagged as a pre-Service Pack 4 (SP4) fix, but I didn’t verify whether the Messenger service fix is included in SP4. Check with PSS and cite the Microsoft article "Computer Stops Responding During Shut Down, and You Receive a 'Disconnecting Network' Error Message" (http://support.microsoft.com/?kbid=823344).