Where’s my file? Root cause analysis of FRS and DFSR data deletion

Dude, where is my file? Root cause analysis procedure for determining who deleted a file in a FRS/DFSR environment

Aaron Tiensivu's Blog — Wed, 05 Sep 2007 08:26:45 GMT

A very technical but very informative article on finding out who deleted a file or folder in a FRS or DFS-R environment. Three things I took away from this article #1: Audit information is very important for tracking this kind of activity. It is po

Top 10 Common Causes of Slow Replication with DFSR

Ask the Directory Services Team — Fri, 05 Oct 2007 20:55:28 GMT

Hi, Ned again. Today I’d like to talk about troubleshooting DFS Replication (i.e. the DFSR service

re: Where’s my file? Root cause analysis of FRS and DFSR data deletion

Yann — Fri, 13 Jun 2008 09:12:57 GMT

Hello,

Very good stuff! :)

I had an issue where the Policies and Scripts folders are morphed as this:

Policies.

Policies_NTFRS_XXXXXX.

Scripts.

Scripts_NTFRS_XXXXX.

These morphed folders appeared at the same time an administrator that did an authoritative restore of an OU.

We wantsto have proofs. Is there a wayto know the "Where, When" those morphed folders appeared, and if possible who did it.

Is there a Tag, in the idtable or elsewhere, that corresponds to a restoration of those morphed folders ?

Thx for your input.

Yann

re: Where’s my file? Root cause analysis of FRS and DFSR data deletion

NedPyle — Fri, 13 Jun 2008 21:23:14 GMT

Hi,

The steps are pretty much identical as above except that you don't care about the FLAGS being set to deleted. There's nothing marking them as morphed bu the name, and you have that piece.

An auth restore of an OU would not be able to cause this issue though - it would have no effect on FRS. But if someone was using GPMC incorrectly (KB929266) or if they set a D4 burflag as part of their steps without setting D2 downstream (Kb315457) it would be very possible that the issue happened at roughly the same time.

re: Where’s my file? Root cause analysis of FRS and DFSR data deletion

Yann — Sun, 15 Jun 2008 11:44:27 GMT

Hello,

Thx for your input. I saw endded the Policies and Scripts morphed folders in the idtable. They refer to a DC.

It seems that if you ticked in the "When restoring replicated data sets, mark the restored data as the primary data for all replicat sets" on the Advanced Retore Options dialog box of the ntbackup Restore tab, this can generate also name-morph conflicts with one set of directory trees having the normal name and the other set having the morphed folders.

Cheers,

Yann

re: Where’s my file? Root cause analysis of FRS and DFSR data deletion

MatM — Fri, 24 Apr 2009 04:25:49 GMT

Hi Ned,

Do you know what flag 6 is when looking at these logs? Is there a table or something I could look at?

re: Where’s my file? Root cause analysis of FRS and DFSR data deletion

NedPyle — Fri, 24 Apr 2009 16:24:10 GMT

Can you post that entry for me? I was reviewing source code to see, but FLAGS is used a lot to mean a lot of things.