Microsoft KB Archive/822300

= FRS Encounters &quot;ERROR_SHARING_VIOLATION&quot; Errors When It Tries to Replicate Data That Is Still in Use =

Article ID: 822300

Article Last Modified on 12/3/2007

-

APPLIES TO


 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows Small Business Server 2003 Premium Edition
 * Microsoft Windows Small Business Server 2003 Standard Edition

-



IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry



SYMPTOMS
On Distributed File System (DFS) replica members or on domain controllers that are hosting a SYSVOL replica set, you may find an event that is similar to the following in the File Replication service (FRS) area of Event Viewer:

Event Type: Warning

Event Source: NtFrs

Event Category: None

Event ID: 13573

Date:

Time:

User: N/A

Computer:

Description: File Replication Service has been repeatedly prevented from updating

File Name :

File GUID : 97130a43-f134-4595-88cc6c87c3d41955

due to consistent sharing violations encountered on the file. Sharing violations occur when another user or application holds a file open, blocking FRS from updating it. Blockage caused by sharing violations can result in out-of-date replicated content. FRS will continue to retry this update, but will be blocked until the sharing violations are eliminated.

Possible reasons for a sharing violation are other sources that may have opened the file to be replicated in on the target machine. To determine the full path of the file in sharing violation open the Computer Management, Shared Folders, Open Files from compmgmt.msc for the file in question and the user that has the file opened. Search for the file listed above, Right click on the file, Select the close option to forcibly close the file. Note if multiple files with the same name are held open you may need to close all or perform more detailed steps listed in the KB article to determine file with full path that matches the GUID reported in the event.



CAUSE
This issue may occur for either of the following reasons:
 * FRS cannot install a file at the destination location because it encountered a sharing violation.
 * FRS cannot generate the staging file to be replicated because FRS encountered a sharing violation.

A sharing violation can occur if other sources have open handles to the file to be replicated. Typically, programs that can instigate sharing violations are:
 * Antivirus programs
 * Disk optimization tools
 * File system policies that repeatedly apply access control list (ACL) changes
 * A user profile or personal data that is constantly in use that is placed on the replica set
 * Any other type of data that is held open for long periods by an end user, a program, or a process



RESOLUTION
To resolve this issue, use one of the following methods.

Method 1: Use the Install Override Feature
You can use the Install Override feature in Windows Server 2003 to rename the locked file. This allows FRS to replicate the file. For additional information about how to turn on this feature and use it, click the following article number to view the article in the Microsoft Knowledge Base:

816493 How to Configure the File Replication Service to Allow Fewer Sharing Violations That Block Replication

Method 2: Identify the Locked Files and Release the Handles
If you are not using Windows Server 2003 or if you do not want to turn on the Install Override feature, the only way to prevent the issue from occurring is to release the handles of the locked files. However, because the 13573 event is only reported for the number of times per hour that is specified in the Max Sharing Violation Event setting, files in the same situation may not have been reported yet. Therefore, to release the handles of all locked files, you must first identify the complete set of open files.

To track the problem in Windows 2000, download and install the fix that is documented in the following Microsoft Knowledge Base article:

815473 File Replication Service Does Not Log Errors on Sharing Violations

With this hotfix, you can set the options to control the logging of event 13573. This hotfix does not contain the &quot;Install Override Feature&quot; that Windows Server 2003 has.

To identify the complete set of files in the INSTALL_RETRY state, run the ntfrsutl.exe inlog command, and then look for all file entries with a state that is marked IBCO_INSTALL_RETRY. To find out the full path of the file that is being held, follow these steps:  Find out the file GUID from either the description of the event ID or from the inlog data that is retrieved. The inlog data will look similar to the following example:

Table Type : Inbound Log Table for DOMAIN SYSTEM VOLUME (SYSVOL SHARE) (1)

Flags : 010000c6 Flags [VVAct Content Retry InstallInc CmpresStage ]

IFlags : 00000001 Flags [IFlagVVRetireExec ]

State : 0000000d CO STATE: IBCO_INSTALL_RETRY

FileGuid : 36a42f7e-b3a9-494c-ae0cef2929771d6e

EventTime : Thu May 29, 2003 19:13:40

FileName : .txt

 Convert the file GUID to a full path by using available tools or by parsing data from the IDTable entries. You can extract this data by using the ntfrsutl idtable command.

Find the Path of a File That Is Being Held Open
To find the path of a file that is being held open, follow these steps:  Obtain FRSDiag.exe, and then run it. To obtain FRSDiag.exe, visit the following Microsoft Web site:

http://www.microsoft.com/downloads/details.aspx?FamilyId=43CB658E-8553-4DE7-811A-562563EB5EBF&displaylang=en

 Type the name of the target server that contains the error, or click Browse, and then locate the server. On the Selections menu, click Uncheck All.</li> Click to select the IDTable Parser check box.</li> Click Go.

A file that is named FRSDiag.txt under the %USERPROFILE%\Desktop\Logs folder is created.</li> Look up the file GUID and the file's date in FRSDiag.txt.</li></ol>

<div class="resolution_section">

After you determine which file is being held open, you can use Process Explorer from Sysinternals to find out which process has the file locked. To download Process Explorer, visit the following Sysinternals Web site:

http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx

To use Process Explorer, follow these steps:
 * 1) Start Process Explorer, and then wait until all the process information is loaded.
 * 2) On the Find menu, click Find Handle or DLL.
 * 3) Type the path of the file (for example, type scripts\filename.txt ), and then click Search.
 * 4) After the process is found, double-click it, and then verify that this is the name of the file that is being held open.
 * 5) End the process if you want to.

Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

The third-party products that are discussed in this article are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.

If you determine that keeping this file open is the expected behavior for your environment, either disable logging of this event, or increase or decrease the number of reported events per hour. To do this, follow these steps to edit the designated registry subkeys.

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.  Start Registry Editor.</li> Locate and then modify the following subkey:

Value Name: Enable Sharing Violation Logging

Value Type: DWORD

Value Range: 0 or 1

Default value: 0

Description: Toggles sharing violation logging on or off.

</li> Locate and then modify the following subkey:

Value Name: Max Sharing Violation Event

Value Type: DWORD

Value Range: 1 to 2000

Default value: 10

Description: Determines the maximum number of reported sharing violation events for each time period.

</li> Locate and then modify the following subkey:

Value Name: Sharing Violation Retry Count

Value Type: DWORD

Value Range: 1 to 2000

Default value: 10

Description: Determines the frequency of sharing violation events for each change order. For example, for a value of 10, report 1 of every 10 sharing violations that are encountered by the change order.

</li></ol>

<div class="references_section">