FRS-to-DFSR Migration Stuck: Resolving Event 13508 and SYSVOL Replication Failures

What You’re Seeing

It is 01:30 during an urgent maintenance window to promote your first Windows Server 2025 domain controller into a long-standing production domain. The Active Directory Domain Services configuration wizard abruptly terminates: modern Windows Server operating systems refuse promotion into any domain still relying on legacy File Replication Service (FRS) for SYSVOL replication. To unblock the upgrade, you connect to the Primary Domain Controller (PDC) Emulator, execute dfsrmig /setglobalstate 1 to initiate the migration to the Prepared state, and wait for the domain controllers to synchronise.

Two hours later, the migration has failed to converge. When you check migration progress across the domain, the state machine reports an unresolved consistency warning:

# Check current migration progress across all domain controllers
dfsrmig /getmigrationstate

The following domain controllers have not reached the requested global state ('Prepared'):

Domain Controller (Local Migration State) - DC Type
===================================================
DC02 ('Preparing') - Writable DC

Migration has not yet reached a consistent state on all domain controllers.
State information might be stale due to Active Directory Domain Services latency.

Logging into the lagging domain controller (DC02) and inspecting the File Replication Service event log reveals the root obstruction: Event ID 13508 logged continuously by the NtFrs provider:

# File Replication Service Event Log - Event ID 13508 (Warning)
Log Name:      File Replication Service
Source:        NtFrs
Date:          10/19/2026 01:45:12 AM
Event ID:      13508
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      DC02.corp.example.com
Description:
The File Replication Service is having trouble enabling replication from DC01.corp.example.com to DC02 for c:\windows\sysvol\domain using the DNS name DC01.corp.example.com. FRS will keep retrying. 
Following are some of the reasons you would see this warning: 

 [1] FRS cannot correctly resolve the DNS name DC01.corp.example.com from this computer. 
 [2] FRS is not running on DC01.corp.example.com. 
 [3] The Active Directory information for this replica has not yet replicated to all the Domain Controllers. 

This event log message will appear once each day, until replication is enabled. Once replication is enabled you will see event 13509.

Simultaneously, opening the DFS Replication log under Applications and Services Logs on DC02 shows that DFSR is unable to proceed with local initialisation, logging Event ID 8028:

# DFS Replication Event Log - Event ID 8028 (Warning)
Log Name:      DFS Replication
Source:        DFSR
Date:          10/19/2026 01:45:30 AM
Event ID:      8028
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      DC02.corp.example.com
Description:
DFSR Migration was unable to transition to the 'PREPARED' state for Domain Controller DC02. DFSR will retry the next time it polls the Active Directory. To force an immediate retry, execute the command 'dfsrdiag /pollad'.
Additional Data:
Error: 2 (The system cannot find the file specified.)

What It Actually Means

Think of the FRS-to-DFSR migration like building a modern high-speed railway directly parallel to an aging steam railway while passenger traffic is still active. The Prepared state (State 1) lays down the new tracks and begins test runs with empty carriages by copying cargo over from the steam platform. Event 13508 means the old steam track between your central station and an outlying junction collapsed months ago. The modern freight train cannot load its containers from an empty, disconnected depot. You cannot inaugurate the modern transit line until you repair the underlying supply route.

The dfsrmig state machine relies on a strict four-state progression managed through Active Directory objects located at CN=DFSR-GlobalSettings,CN=System,DC=corp,DC=example,DC=com:

When you execute dfsrmig /setglobalstate 1 on the PDC Emulator, the global directive updates in Active Directory. Each domain controller must discover the directive, enter the transitional 'Preparing' state, clone the local FRS SYSVOL data into C:\Windows\SYSVOL_DFSR, establish a DFSR replication partnership, and confirm initial sync.

If a domain controller is impaired by Event 13508, its local FRS replica set is frozen. The File Replication Service has suspended inbound partner replication due to network timeouts, name resolution failures, or uncommitted journal entries. Because the local FRS folder is either empty, incomplete, or unshared, DFSR cannot complete its baseline initialisation. The global migration stalls because dfsrmig will never advance the domain until 100% of writable domain controllers report successful transition.

How to Diagnose

Diagnosing a stalled migration requires isolating whether the failure stems from Active Directory replication latency, local transport failures, or FRS database corruption. Follow this structured sequence from global state checks down to protocol transport.

First, check the global and local migration states from the PDC Emulator to identify all lagging domain controllers:

# 1. Query the authoritative global state in Active Directory
dfsrmig /getglobalstate

# 2. Enumerate individual migration status for all domain controllers
dfsrmig /getmigrationstate

Once you identify the stuck server (e.g., DC02), log into that specific domain controller. Query its File Replication Service event log to isolate which partner DC is failing and examine whether recovery events have occurred:

# 3. Inspect recent FRS warning and error records on the affected DC
Get-WinEvent -FilterHashtable @{
    LogName = 'File Replication Service'
    Id      = 13508, 13509, 13568
} -MaxEvents 10 |
Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

If Event ID 13508 is present without a subsequent Event ID 13509 (“The File Replication Service has enabled replication…”), FRS replication remains offline. Next, inspect the DFS Replication event log to confirm whether DFSR is trapped in a retry loop:

# 4. Check DFS Replication migration transition events
Get-WinEvent -FilterHashtable @{
    LogName = 'DFS Replication'
    Id      = 8028, 8014, 8004
} -MaxEvents 10 |
Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Because Event 13508 explicitly cites DNS or RPC transport problems, test network communication between DC02 and the upstream partner specified in the event text (DC01):

# 5. Verify forward DNS A record resolution for the partner DC
Resolve-DnsName -Name "dc01.corp.example.com" -Type A

# 6. Verify Active Directory DC locator SRV record resolution
Resolve-DnsName -Name "_ldap._tcp.dc._msdcs.corp.example.com" -Type SRV

# 7. Test transport reachability to RPC Endpoint Mapper (TCP Port 135)
Test-NetConnection -ComputerName "dc01.corp.example.com" -Port 135

# 8. Test transport reachability to LDAP (TCP Port 389)
Test-NetConnection -ComputerName "dc01.corp.example.com" -Port 389

Next, check whether the File Replication Service daemon (NtFrs) is running on the partner DC, and verify whether DC02 has successfully exposed its administrative shares:

# 9. Verify the service status of NtFrs on both local and partner DCs
Get-Service -ComputerName "dc01.corp.example.com" -Name "NtFrs"
Get-Service -Name "NtFrs"

# 10. Check if SYSVOL and NETLOGON shares exist on the local DC
net share

If net share does not display SYSVOL and NETLOGON, FRS has unshared the directories due to an uninitialised replica set. Finally, confirm whether underlying Active Directory directory partition replication is functioning cleanly:

# 11. Review enterprise-wide Active Directory replication health
repadmin /replsummary

# 12. Inspect inbound replication status specifically on the stuck DC
repadmin /showrepl

Common Causes

Event 13508 during an active FRS-to-DFSR migration is almost always caused by one of seven distinct root causes spanning name resolution, network firewalls, and legacy replica corruption:

The Fix: Restoring Replication and Completing Migration

Resolving a migration stalled by Event 13508 requires repairing the legacy FRS transport, verifying share re-initialisation, forcing DFSR state convergence, and completing the migration cycle.

Step 1: Remediate the transport or service failure. If Test-NetConnection revealed port 135 filtering, open RPC communication between the domain controllers. If the NtFrs service was halted on the source DC (DC01), start it. If DNS failed to resolve the partner’s domain record, register DNS records on DC01:

# Force dynamic DNS record registration on the source domain controller
ipconfig /registerdns

# Restart Netlogon to re-register Active Directory locator records
Restart-Service -Name "Netlogon"

Step 2: Recover from an FRS Journal Wrap condition (if applicable). If FRS replication has been broken for longer than the NTFS change journal threshold, the File Replication Service will log Event ID 13568 and refuse to synchronise until an administrator authorises recovery. To fix this, perform a non-authoritative initialisation (BurFlags D2) on the failing DC (DC02):

# 1. Stop the File Replication Service on the affected domain controller
Stop-Service -Name "NtFrs" -Force

# 2. Configure a non-authoritative restore by setting BurFlags to 0xD2 (hexadecimal)
reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup" /v BurFlags /t REG_DWORD /d 0xd2 /f

# 3. Start the File Replication Service
Start-Service -Name "NtFrs"

Step 3: Confirm FRS recovery and share restoration. Monitor the File Replication Service event log on DC02. Within minutes of remediating the root blocker or applying BurFlags D2, you must see Event ID 13509, followed by Event ID 13516:

# Query the File Replication Service log for successful initialisation events
Get-WinEvent -FilterHashtable @{
    LogName = 'File Replication Service'
    Id      = 13509, 13516
} -MaxEvents 5 | Format-Table TimeCreated, Id, Message -Wrap

# Verify that SYSVOL and NETLOGON shares have reappeared
net share

Step 4: Force Active Directory synchronisation and DFSR polling. Now that the legacy FRS SYSVOL folder is healthy and shared, force Active Directory replication across all domain controllers, and instruct the DFSR engine on DC02 to poll Active Directory for its migration instructions:

# Force Active Directory replication across all partitions and DCs
repadmin /syncall /AdeP

# Force DFSR on DC02 to poll Active Directory immediately
dfsrdiag pollad

Within several minutes, the DFSR event log on DC02 will log Event ID 8014 (“DFSR Migration successfully transitioned to the ‘PREPARED’ state”). Re-run the migration verification command on the PDC Emulator:

# Confirm that all domain controllers have reached the Prepared state
dfsrmig /getmigrationstate

All Domain Controllers have migrated successfully to the Global state ('Prepared').
Migration has reached a consistent state on all domain controllers.
Succeeded.

Step 5: Advance the migration through Redirected and Eliminated. With State 1 stable, proceed through the final two stages of the migration state machine from your PDC Emulator:

# 1. Advance the domain to State 2 (Redirected)
dfsrmig /setglobalstate 2

# 2. Monitor state convergence until all DCs report Succeeded
dfsrmig /getmigrationstate

# 3. Verify that the SYSVOL share now points to SYSVOL_DFSR on each DC
net share

# 4. Advance the domain to State 3 (Eliminated)
dfsrmig /setglobalstate 3

# 5. Confirm final migration completion
dfsrmig /getmigrationstate

How to Prevent It

Preventing migration stalls requires proactive hygiene before touching the migration command line, coupled with permanent retirement of legacy services.

First, execute rigorous pre-flight validation before altering any global migration states. Run dcdiag with specific replication and SYSVOL switches to uncover hidden FRS journal failures or missing shares prior to starting:

# Execute pre-migration diagnostic checks across directory and replication services
dcdiag /e /test:sysvolcheck /test:frsevent /test:replications

Second, clean up demoted domain controller metadata. If an old server was pulled from the rack without running clean demotion routines, its lingering FRS subscriber objects will permanently block dfsrmig /getmigrationstate from reaching consistency. Verify all domain controllers listed in Active Directory Sites and Services represent active, operational hardware.

Third, finish the migration. Leaving a production domain indefinitely in State 1 (Prepared) or State 2 (Redirected) exposes your environment to the worst operational overhead of both worlds: running two concurrent file replication daemons that compete for disk I/O and network bandwidth. Once State 2 is validated, commit to State 3 (Eliminated) to permanently decommission FRS, removing Event 13508 failure modes from your forest forever. For fine-tuning your new DFSR replica once migration is complete, see our operational guide on DFS Replication Staging and Quota Configuration.

Final Thoughts

The File Replication Service was designed in the late 1990s for Windows 2000 Server, long before modern multi-gigabit topologies and virtualised datacentres existed. It relies on an unindexed, fragile database engine that easily falls out of synchronisation when network hiccups or reboot cycles interrupt NTFS change journals. When dfsrmig stalls on Event 13508, the failure is not an indictment of modern DFSR; it is a direct consequence of inheriting legacy technical debt. By isolating transport channels, executing a non-authoritative BurFlags restore where required, and driving the state machine through to completion, you can eliminate legacy replication vulnerabilities and modernise your Active Directory infrastructure.