FRSDiag v1.7

by Luiz Miranda (luizm)

USAGE:
    - Run FRSDiag.exe which will extract the files and run the extracted FRSDiag.exe automatically
    - The tool can be run remotely (including 2000/XP workstations)

Minimum Requirements:
    - you MUST have the Microsoft .NET Framework for this to run, it can be downloaded at:
        * You can grab it from http://windowsupdate.microsoft.com web site under Recommended Downloads
        * You can also directly download the .NET Framework from:
            http://download.microsoft.com/download/a/a/c/aac39226-8825-44ce-90e3-bf8203e74006/dotnetfx.exe

Information it Grabs by Default:
    - Event Log(s)
    - ntfrsutl Output(s)
    - FRS Debug Log(s)
    - FRS Registry Dump
    - SYSVOL Dump
    - Repadmin /showreps and /showconn

Further Information it Creates:
    - FRS Debug Logs Errorscan
    - FRSDiag.txt -- contains results of tests
    - FRSDiag_Log.txt -- contains information about which tests were requested
    - Connstat.txt -- parses out the sets.txt into a more readable format
    - IDTable.txt -- parses out the IDTable into a more readable format with full file paths
    - .CAB with everything ready to be sent back to us

Tools:
    - GUID2Name :: Build a server GUID-to-name correlation (outputted to a Text File) against selected server(s)
    - ForceReplication :: Force Replication on Target Server(s) which causes target server to replicate all changes FROM parent (Pull Replication) regardless of inter-site schedules set
        - Note: This feature only works if you are running at least SP3+Q811370 (Windows 2000 SP4) or Windows 2003. Also, it only works against SYSVOL and not DFS volumes.
    - Propagation File Tracer :: This can be used to check several things such as:
            - Check for the existence of a single (propagation) file in SYSVOL
            - Current FRS replication consistency (number of files/folders existing in each server)
            - Look for morphed folders existing in the replica set
            - Look for no longer needed Pre_Existing folders
            - and any other pattern imagined which can be derived by the use of wildcards in conjunction to filter(s)
        - Note: The retry feature also works well here to keep checking servers that fail the specified checks.
        - Also note this currently only works for SYSVOL replica sets, not DFS.
    - Set Debug Logging Settings :: Ability to remotely change or delete NtFrs Debug Logging registry values on Target Server(s). The following can be changed:
        - Debug Log Severity
        - Debug Log Files
        - Debug Maximum Log Messages
        - Debug Log File
        - Restart NtFrs Service (after Settings are set)

Tests it performs:
    - FRS Event Log*:
        - Tests for Errors and Warnings (filters when newer 13516 exists)
        - Tests 13508 warnings for unmatched 13509
        - Filters when event if over 10 days old AND is not one of the latest 7 events

    - DS Event Log*:
        - Tests for Errors in the last 12 days

    - ntfrs_version:
        - Tests for minimum FRS version requirements

    - ntfrs_DS Services:
        - Tests for (null) or broken serverReference objects
        - Tests for member servers with no connection objects
        - Tests for disabled connection objects*
        - Tests for null or improperly set fRSMemberReference on SYSVOL volumes
        - Tests for (null) values on fRSMemberReference on DFS volumets

    - ntfrs_Replica Sets:
        - Warns about FileFilters not set to default values*
        - Warns about DirectoryFilters not set to default values*
        - Warns when Daily Schedule for a server's replica partner is less than 4 hours per day
        - Warns when Weekly Schedule for a server's replica partner is less than 48 hours per week
        - Errors when Weekly Schedule for a server's replica partner is less than 24 hours per week

    - ntfrs_Connstat*:
        - Warns when number of Backlog files is greater than 30 files
        - Errors when number of Backlog files is greater than 100 files

    - ntfrs_Config Table:
        - Appropriate free disk space
            - Insures all staging area locations have at least 384 MB of free space (see KB.819268)

        - FRS Structure (if SYSVOL Dump is Selected)
            - Tests for existance of SYSVOL folder
            - Tests for existance of SYSVOL junction point
            - Tests for existance of staging area folder
            - Tests for existance of staging area junction point

    - ntfrs_Stage:
        - Appropriate staging area size
            - Warns when the staging area is over 60% full
            - Errors when the staging area is over 85% full (disk is thrashing)

    - Inlog/Outlog*:
        - Warns when 15% of change orders were triggered by "Security" change
        - Errors when 40% of change orders were triggered by "Security" change

    - IDTable:
        - Errors when an idtable entry (file or directory) is found with no parent (missing parent issue), details about the idtable entry is written

    - FRS Debug Logs:
        - ERROR_SHARING_VIOLATION errors*
        - ERROR_ACCESS_DENIED errors*
        - IBCO_STAGING_RETRY errors
        - IBCO_FETCH_RETRY errors
        - IBCO_INSTALL_RETRY errors
        - Missing Parent Issue Fixed in Q811217
        - INVALID Join guid Fixed in Q811217

    - Services and Shares:
        - Insures the following needed services are Running:
            - NtFrs
            - W32Time
            - Netlogon
            - Server and Workstation
            - RpcSs (RPC Service)
        - Tests if SYSVOL and NETLOGON shares exist and are accessible (Only done if machine is a Domain Controller)

    - Registry Dump:
        - Checks for HKLM Registry Key triggers as defined in FRSDiag.ini. Default regkeys checked are:
            - SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup\Burflags
            - SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\RPC TCP/IP Port Assignment
            - SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\File Inclusion Filter List
            - SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Enable Journal Wrap Automatic Restore
            - SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\SysvolReady
            - SOFTWARE\Microsoft\Rpc\Internet\Ports
            - SOFTWARE\Microsoft\Rpc\Internet\PortsInternetAvailable
        - for more information on what it checks for see FRSDiag.ini

    - Repadmin /showreps
        - Tests for any failed Active Directory replication events

* = NOTE: A server failing this test may not necessarily mean there is a problem


Options:
    - Auto-Retry Target Server(s) that failed to grab data : This option lets you enable Auto-Retry when processing multiple servers. This is helpful for large environments where a server may be unavailable at that time but you must have information from all servers therefore keep trying until the server comes back up. It can be toggled on/off during execution.
    - Attempt to DnsResolve prior to starting : This option checks if you are able to resolve the Target Server(s) name and if that server is accessable at this time. It should only be turned off on large environments where you'd like to keep retrying for down servers and are confident name resolution is working correctly
    - Create "Logs" Directory for data output :: This option is to create a "Logs" directory where all output data will go to (if this is not checked, output is generated from the location frsdiag.exe was called from, usually on the root of where it resides)