Param
(
  [switch] $Fix
)


Import-Module activedirectory

$Today = Get-Date -uformat "%m/%d/%y"

###############
# Get DC Info #
###############
$DCInfo = Get-ADDOmainController -Identity $DCName
$DCHostName = $DCInfo.HostName
$DCOS = $DCInfo.OperatingSystem

##########################
# Check for Journal Wrap #
##########################
##
Write-Output "Restarting NTFRS Service to verify that the DC is in Journal Wrap `r "
Restart-Service "NTFRS"

##  
Write-Output "Check the FRS event log for Journal Wrap events on $DCHostName... `r"
 IF ($DCOS -like "*2008*")
        {  ## OPEN IF DC OS is 2008 or newer, use Get-WinEvent
          $DCEvents = Get-WinEvent -LogName "File Replication Service" -MaxEvents 25
          $DCFRSEvents = $DCEvents | Select-Object TimeCreated,ID,ProviderName,Message | Where { $_.TimeCreated -like "*$Today*" }
        }  ## CLOSE IF DC OS is 2008 or newer, use Get-WinEvent
      ELSE
        {  ## OPEN ELSE DC OS is not 2008 or newer, use Get-EventLog
          $DCEvents = Get-EventLog -LogName "File Replication Service" -after (get-date).AddHours(-1)
          $DCFRSEvents = $DCEvents | Select-Object TimeGenerated,EventID,Source,Message | Where { $_.TimeCreated -like "*$Today*" }
        }  ## CLOSE ELSE DC OS is not 2008 or newer, use Get-EventLog
   
[switch]$DCJournalWrap = $False
ForEach ($Event in $DCFRSEvents)
    {  ## OPEN ForEach Event in DCFRSEvents
        IF ($Event.ID -eq "13568")
           {  ## OPEN IF Event.ID = "13568" aka "Journal Wrap"
             $Event13568 = $True
             $EventDateTime = $Event.TimeCreated
             $EventID = $Event.ID
             [array]$JournalWrapEvents += $EventDateTime
             $DCJournalWrap = $True
             Write-Host "$DCHostName has logged a Journal Wrap in the event log. `r " -fore Red
           }  ## CLOSE IF Event.ID = "13568" aka "Journal Wrap"
           
        IF ($Event.EventID -eq "13568")
           {  ## OPEN IF Event.EventID = "13568" aka "Journal Wrap"
             $Event13568 = $True
             $EventDateTime = $Event.TimeGenerated
             $EventID = $Event.EventID
             [array]$JournalWrapEvents += $EventDateTime
             $DCJournalWrap = $True
             Write-Host "$DCHostName has logged a Journal Wrap in the event log. `r " -fore Red
           }  ## CLOSE IF Event.EventID = "13568" aka "Journal Wrap"
    }  ## CLOSE ForEach Event in DCFRSEvents

IF ( ($DCInJournalWrap -eq $True) -AND ($Fix -eq $True) )
 {  ## OPEN IF $DCInJournalWrap = $True AND $Fix = $True
###################################
# Perform Journal Wrap Resolution #
###################################
##    
Write-Output "Discovered the DC is currently in Journal Wrap. Performing Resolution Steps... `r "

Write-Output "Stopping the NTFRS service `r "
Stop-Service "NTFRS"

Write-Output "Setting the NTFRS BurFlags to D2 (nonauthoritative restore) on $DCHostName `r "
$key = "System\CurrentControlSet\Services\NTFRS\Parameters\Backup/Restore\Process at Startup"
$valuename = "BurFlags"
$reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $DCHostName)
$regkey = $Reg.opensubkey($key,$true)
$RegKeyValue = $regkey.getvalue($valuename)
$regkey.SetValue("BurFlags","D2")
 
Write-Output "Stopping the NTFRS service `r "
Start-Service "NTFRS"
 
##
Write-Output "Waiting for the NTFRS service to start on $DCHostName `r "
Start-Sleep -seconds 30

##
Write-Output "Checking event log for FRS NonAuthoritative Restore `r "
      IF ($DCOS -like "*2008*")
        {  ## OPEN IF DC OS is 2008 or newer, use Get-WinEvent
          $DCEvents = Get-WinEvent -ComputerName $DCHostName -LogName "File Replication Service" -MaxEvents 25
          $DCFRSEvents = $DCEvents | Select-Object TimeCreated,ID,ProviderName,Message | Where { $_.TimeCreated -like "*Today*" }
        }  ## CLOSE IF DC OS is 2008 or newer, use Get-WinEvent
      ELSE
        {  ## OPEN ELSE DC OS is not 2008 or newer, use Get-EventLog
          $DCEvents = Get-EventLog -ComputerName $DCHostName -LogName "File Replication Service" -after (get-date).AddHours(-1)
          $DCFRSEvents = $DCEvents | Select-Object TimeGenerated,EventID,Source,Message | Where { $_.TimeCreated -like "*Today*" }
        }  ## CLOSE ELSE DC OS is not 2008 or newer, use Get-EventLog

[switch]$DCD2Event = $False
ForEach ($Event in $DCFRSEvents)
    {  ## OPEN ForEach Event in DCFRSEvents
        IF ($Event.ID -eq "13565")
           { $DCD2Event = $True }
        IF ($Event.EventID -eq "13565")
           { $DCD2Event = $True }
    }  ## CLOSE ForEach Event in DCFRSEvents
 
IF ($DCD2Event -eq $True)
  { Write-Output "The FRS D2 NonAuthoritative Restore was Initiated on $DCHostName and this can take anywhere from 5 minutes up to several hours. You can check in later on the status. `r " }
 ELSE { Write-Output "No event was found in the FRS log for the FRS D2 NonAuthoritative Restore. Check this log for event ID #13565 `r "  }
##