Tình huống xảy ra khi khắc phục ID 13568, NTFrs và hậu quả của nó!

Mặc dù lỗi này xuất hiện khá lâu nhưng mãi gần đây sau khi người dùng phản ánh việc file đã xóa xuất hiện trở lại, thỉnh thoảng user's profile không load được ...
Chẩn đoán do nguyên nhân số 5 chỉ ra trong log, fix bằng cách làm theo hướng dẫn, add DWORD Value Enable Journal Wrap Automatic Restore = 1
... và sau đó thảm họa xảy ra
----------------Event ID 13568 File Replication Service------------------
The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR.

 Replica set name is    : "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
 Replica root path is   : "c:\windows\sysvol\domain"
 Replica root volume is : "\\.\C:"
 A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found.  This can occur because of one of the following reasons.

 [1] Volume "\\.\C:" has been formatted.
 [2] The NTFS USN journal on volume "\\.\C:" has been deleted.
 [3] The NTFS USN journal on volume "\\.\C:" has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.
 [4] File Replication Service was not running on this computer for a long time.
 [5] File Replication Service could not keep up with the rate of Disk IO activity on "\\.\C:".
 Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.
 [1] At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run "net stop ntfrs" followed by "net start ntfrs" to restart the File Replication Service.
 [2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.

WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.

To change this registry parameter, run regedit.

Click on Start, Run and type regedit.

Expand HKEY_LOCAL_MACHINE.
Click down the key path:
   "System\CurrentControlSet\Services\NtFrs\Parameters"
Double click on the value name
   "Enable Journal Wrap Automatic Restore"
and update the value.

If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above.
---------------------
Mặc dù có backup (nhưng lại backup sau khi fix lỗi và trước khi update, thế mới ngu) nhưng sau đó xuất hiện một loại lỗi. Sau khi nghiền ngẫm log thì thấy nổi lên 2 vấn đề:
+ ntfrs jet database corupt -> ID 13566 File Replication Servive xuất hiện
-----------------------
File Replication Service is scanning the data in the system volume. Computer PDC cannot become a domain controller until this process is complete. The system volume will then be shared as SYSVOL.

To check for the SYSVOL share, at the command prompt, type:
net share

When File Replication Service completes the scanning process, the SYSVOL share will appear.

The initialization of the system volume can take some time. The time is dependent on the amount of data in the system volume.
----------------------------
Do quá trình này ko kết thúc -> SYSVOL không share -> GC is not available -> tạo ra lỗi mới
ID 1126 Active Directory Domain Services
-----------------
Active Directory Domain Services was unable to establish a connection with the global catalog.

Additional Data
Error value:
1355 The specified domain either does not exist or could not be contacted.
Internal ID:
3200e25

User Action:
Make sure a global catalog is available in the forest, and is reachable from this domain controller. You may use the nltest utility to diagnose this problem.
----------------------
và lỗi ID 14550 DfsSvc
------------
The DFS Namespace service could not initialize cross forest trust information on this domain controller, but it will periodically retry the operation. The return code is in the record data.
------------------
Do shared sử dụng DFS nên user's profile không load được....
Nguồn tham khảo:
http://blog.ronnypot.nl/?p=738#comment-21619 (***)
http://social.technet.microsoft.com/Forums/en/winserverDS/thread/6062b0a1-3294-4e27-900e-017259bb56f4
https://www.chicagotech.net/~chicagot/server/ad&dc3.htm
Cập nhật: sau khi SYSVOL đã share không còn GPO và script nữa -> deploy GPO failed. Revert trở lại bản backup cũ, copy toàn bộ nội dung sang phiên bản mới -> Done
Sau đó triển khai ngay thêm một dc nữa để dự phòng.

Rút kinh nghiệm, lần này chỉ đọc nhiều, thực hành ít nên cuối cùng sự cố đã được xử lý ổn thỏa. Chỉ mất quá nhiều thời gian mà thôi