The Ultrasound tool may report incorrect sharing violations when you monitor FRS in Windows Server 2003 or in Windows 2000

When you use the Ultrasound tool to monitor the File Replication Service (FRS) and to track sharing violations on a server that is running Microsoft Windows Server 2003 or Microsoft Windows 2000, a sharing violation may occur. However, you cannot verify the sharing violation by using the following tools to display the open handles on the server:

�	The net file or net files command
�	The Oh.exe tool

Certain sharing violations that are logged to the Current sharing violations (member) view or that are logged to the Current sharing violations (replica set) view of the Ultrasound tool may be incorrect.

Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To resolve this issue, configure the Ultrasound tool to monitor the event logs for occurrences of sharing violation event ID 13573 when the tool tracks sharing violations. To do this, install the latest version of Ntfrs.exe on the server, and then add the Enable Sharing Violation Logging registry entry to the following registry subkey:Note After you perform this procedure, the Ultrasound tool logs sharing violations that are based on the occurrence of event ID 13573 to the new Current sharing violations (events) view. However, the Ultrasound tool still logs sharing violations to the Current sharing violations (member) view and to the Current sharing violations (replica set) view. For a more accurate view of the sharing violations that are reported by the Ultrasound tool, view the sharing violations that are logged to the Current sharing violations (events) view.

To install the latest version of Ntfrs.exe on the server, install one of the following hotfixes, depending on the operating system that you are running:

�	If you are running Windows Server 2003, install the hotfix that is described in the following article in the Microsoft Knowledge Base: 823230 Issues that are resolved in the pre-Service Pack 1 release of Ntfrs.exe
�	If you are running Windows 2000 Server, install the hotfix that is described in the following article in the Microsoft Knowledge Base: 815473 File Replication Service does not log errors on sharing violations

To add the Enable Sharing Violation Logging registry entry, follow these steps:

1.	Click Start, click Run, type regedit, and then click OK.
2.	Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ntfrs\Parameters
3.	On the Edit menu, point to New, and then click DWORD Value.
4.	Type Enable Sharing Violation Logging, and then press ENTER.
5.	On the Edit menu, click Modify.
6.	In the Value data box, type 1, and then click OK.
7.	Quit Registry Editor.

Ultrasound is a monitoring and troubleshooting tool for FRS. The Ultrasound tool measures the health of FRS replica sets and provides health ratings and historical information about replica sets. You can use the tool to monitor the progress of replication and to detect problems that can cause replication to become backlogged or stopped. For more information about the Ultrasound tool, visit the following Microsoft Web site: To view a list of frequently asked questions (FAQ) about the Ultrasound tool, visit the following Microsoft Web site: For more information about how to monitor and troubleshoot FRS, visit the following Microsoft Web site: For additional information, click the following article number to view the article in the Microsoft Knowledge Base: