Why am I receiving a large number of Event ID 13507, 13552, and 13555 messages on the domain controller?

John Savill

September 10, 2000

1 Min Read
ITPro Today logo in a gray background | ITPro Today

A. This problem occurs on domain controllers that have the Windows 2000 Server Terminal Services component installed in application server mode and also have the Citrix MetaFrame 1.8 add-on installed. All three event IDs refer to the File Replication System (FRS). MetaFrame has a neat option to remap the servers' drive letters (e.g., C becomes M) to let Citrix clients continue to see local drives as C, D, etc. The problem is that when the drive is remapped, FRS doesn't work because it's looking for the old drive letters, which no longer exist.

To resolve this problem, perform the following steps (you'll need another machine to temporarily make a domain controller):

  1. Install another Win2K Server-based computer as an additional domain controller (to save any created user accounts or permissions).

  2. Run the dcpromo.exe file to demote the domain controller that has Citrix MetaFrame installed to a member server on the domain.

  3. Run the dcpromo.exe file again to promote the member server back to a replica domain controller on the domain. Doing so allows the ntds.dit file, the System Volume (SYSVOL) folder, and log files to be created on the drive that Citrix MetaFrame has remapped as N:.

  4. Stop NetLogon and FRS on the domain controller.

  5. Delete the ntfrs.jdb file in the %Windir%NtfrsJet folder.

  6. Delete the edb.txt file in the %Windir%NtfrsJetSys folder.

  7. Delete the edb.txt, res1.txt, and res2.txt files in the %Windir%NtfrsJetLog folder.

  8. Restart the domain controller.

The system should now start and run properly.

About the Author

Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.

You May Also Like