On Server 2012 Essentials, I run the native Windows Server Backup two times per day. I get the warning message below one time during each backup. The message appears 32 seconds after the backup starts.
Log Name: DFS Replication
Source: DFSR
Event ID: 2213
Level: Warning
Description:
The DFS Replication service stopped replication on volume C:. This occurs when a DFSR JET database is not shut down cleanly and Auto Recovery is disabled. To resolve this issue, back up the files in the affected replicated folders, and then use the ResumeReplication WMI method to resume replication.
Additional Information:
Volume: C:
GUID: F83647D3-3447-11E2-93ED-806E6F6E6963Recovery Steps
1. Back up the files in all replicated folders on the volume. Failure to do so may result in data loss due to unexpected conflict resolution during the recovery of the replicated folders.
2. To resume the replication for this volume, use the WMI method ResumeReplication of the DfsrVolumeConfig class. For example, from an elevated command prompt, type the following command:
wmic /namespace:\\root\microsoftdfs path dfsrVolumeConfig where volumeGuid=”F83647D3-3447-11E2-93ED-806E6F6E6963″ call ResumeReplication
For more information, see http://support.microsoft.com/kb/2663685.
The DFSR warning is included every day in the Health Report email under “Critical Errors”.
Analysis
To my knowledge, I am not using DFS Replication. However, working with Microsoft partner support, I learned that DFS Replication is running on Server 2012 Essentials by default, and that Windows Server Backup will back up the DFSR database a during backup.
The rep asked about the value of this registry key:
HKLM\System\CurrentControlSet\Services\DFSR\Parameters\StopReplicationOnAutoRecovery
which on my server is set to 1.
The Fix
Partner support recommended running the wmic command shown in the event description. Once I did that, the error stopped and has not returned in over a month.
Note that although the event description refers to Volume C:, the GUID F83647D3-3447-11E2-93ED-806E6F6E6963 is actually the 350MB System Reserved area at the beginning of the volume (no drive letter). Why that System Reserved area has to be configured for replication, or why replication is installed by default in the first place, I don’t know.
Update July 6, 2013 The 2213 events started appearing again after a system crash, which no doubt did result in lots of things not shutting down cleanly. I ran the wmic command from the message again.