Files that are copied into replicated file shares may not be replicated for an unexpectedly long time when antivirus software is installed on the originating server

New files that are copied into replicated file shares on Windows Server 2003 R2-based or on Windows Server 2008-based computers may not be replicated for an unexpectedly long time. This issue may occur when antivirus software is installed on the originating server.

During an originating write to the NTFS file system, such as when a new file is created, Ntfs.sys must update its NTFS change journal. The File Replication Service (FRS) and the Distributed File System Replication (DFSR) service are responsible for synchronizing replicated folders. FRS and DFSR use this NTFS change journal to determine when items have changed, and when such items require replication.

When a kernel-mode application, such as an antivirus application, opens a read-only section while another application uses a read/write section (For example, an application uses a read/write section when a new file is created.), the NTFS change journal may not be updated. In this scenario, a new file is not replicated when an external activity opens the file again. Then, the journal will be updated.

To resolve this issue, apply the hotfix package that is described in the Microsoft Knowledge Base article 953325. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

In a typical scenario where this problem occurs, DFSR or FRS together with Microsoft Forefront Client Security are installed on the same computer. Other antivirus applications may also have this problem, depending on the APIs that they use.