ntfrsutl.exe

  • File Path: C:\Windows\system32\ntfrsutl.exe
  • Description: Utility to dump dynamic state of File Replication Service.

Hashes

Type Hash
MD5 748987A95E3203D1075EBCD0B105E055
SHA1 9C448FE1E5A9A6EE0011275C3F790C17EE3FDD66
SHA256 D81D35C974EC1ACA1B1ECC2741D3BA2090BBE9EF8A6FE18A6AEAD643C66E5F34
SHA384 0AFAAAE96454736E5A9CBEB6A6E9402668E03A40CC4C4411672184B0EBA6A248F750457C09BF17A776C5F84004C79365
SHA512 DCA16739A07FA80799E64EC35393F863547B0CB9B6E1DBB8CA35F23947F30A58FFEB5929DD56F6C93AF58ADA39674894CD911171EA1201D76EE1342D58822660
SSDEEP 384:QQBZ6O+VOF5Bodhlqaaels5P4VOeOaRqr6RfUcsLWgNW:QQvzwOF5a/qahOpaRTRfUbX

Runtime Data

Usage (stdout):

Ntfrsutl dumps the internal tables, thread and memory information
for the ntfrs service.It runs against local as well as remote server.

Note : To access the internal information, the logged in user should
       have the required access on the following registry keys on the
       target server.

       HKLM\System\CCS\Services\Ntfrs\Parameters\Access Checks\
            Get Internal Information : Full control
            Get Ds Polling Interval  : Read
            Set Ds Polling Interval  : Full Control

ntfrsutl [idtable | configtable | inlog | outlog] [computer]
	          = enumerate the service's idtable/configtable/inlog/outlog 
	computer  = talk to the NtFrs service on this machine.

ntfrsutl [memory|threads|stage] [computer]
	          = list the service's memory usage
	computer  = talk to the NtFrs service on this machine.

ntfrsutl ds [computer]
	          = list the service's view of the DS
	computer  = talk to the NtFrs service on this machine.

ntfrsutl sets [computer]
	          = list the active replica sets
	computer  = talk to the NtFrs service on this machine.

ntfrsutl version [computer]
	          = list the api and service versions
	computer  = talk to the NtFrs service on this machine.

ntfrsutl forcerepl [computer] /r SetName /p DnsName
	          = Force FRS to start a replication cycle ignoring the schedule.
	          = Specify the SetName and DnsName.
	computer  = talk to the NtFrs service on this machine.
	SetName   = Name of the replica set.
	DnsName   = DNS name of the inbound partner to force repl from.

ntfrsutl poll [/quickly[=[N]]] [/slowly[=[N]]] [/now] [computer]
	          = list the current polling intervals.
	now       = Poll now.
	quickly   = Poll quickly until stable configuration retrieved.
	quickly=  = Poll quickly every default minutes.
	quickly=N = Poll quickly every N minutes.
	slowly    = Poll slowly until stable configuration retrieved.
	slowly=   = Poll slowly every default minutes.
	slowly=N  = Poll slowly every N minutes.
	computer  = talk to the NtFrs service on this machine.


Usage (stderr):

Don't understand --help

Loaded Modules:

Path
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\system32\ntfrsutl.exe

Signature

  • Status: Signature verified.
  • Serial: 33000001C422B2F79B793DACB20000000001C4
  • Thumbprint: AE9C1AE54763822EEC42474983D8B635116C8452
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: NTFRSUTL.EXE.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.17763.1 (WinBuild.160101.0800)
  • Product Version: 10.0.17763.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


ntfrsutl

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Dumps the internal tables, thread, and memory information for the NT File Replication Service (NTFRS) from both the local and remote servers. The recovery setting for NTFRS in Service Control Manager (SCM) can be critical to locating and keeping important log events on the computer. This tool provides a convenient method of reviewing those settings.

Syntax

ntfrsutl[idtable|configtable|inlog|outlog][<computer>]
ntfrsutl[memory|threads|stage][<computer>]
ntfrsutl ds[<computer>]
ntfrsutl [sets][<computer>]
ntfrsutl [version][<computer>]
ntfrsutl poll[/quickly[=[<n>]]][/slowly[=[<n>]]][/now][<computer>]

Parameters

Parameter Description
idtable Specifies the ID table.
configtable Specifies the FRS configuration table.
inlog Specifies the inbound log.
outlog Specifies the outbound log.
<computer> Specifies the computer.
memory Specifies the memory usage.
threads Specifies the memory usage.
stage Specifies the memory usage.
ds Lists the NTFRS service’s view of the DS.
sets Specifies the active replica sets.
version Specifies the API and NTFRS service versions.
poll Specifies the current polling intervals.<ul><li>/quickly - Polls quickly until it retrieves a stable configuration.</li><li>/quickly= - Polls quickly every default number of minutes.</li><li>/quickly=<n> - Polls quickly every n minutes.</li><li>/slowly - Polls slowly until it retrieves a stable configuration.</li><li>/slowly= - Polls slowly every default number of minutes.</li><li>/slowly=<n> - Polls slowly every n minutes.</li><li>/now - Polls now.</li></ul>
/? Displays help at the command prompt.

Examples

To determine the polling interval for file replication, type:

C:\Program Files\SupportTools>ntfrsutl poll wrkstn-1

To determine the current NTFRS application program interface (API) version, type:

C:\Program Files\SupportTools>ntfrsutl version

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.