Windows Event ID 5805 – DFSR: Database Recovery Completed Successfully

Start by examining the specific details of Event ID 5805 and correlating it with system events to understand the recovery context.

1. Open Event Viewer and navigate to Applications and Services Logs → DFS Replication
2. Locate Event ID 5805 and review the event details for recovery duration and affected databases
3. Check the System log for events around the same timeframe:

   Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=(Get-Date).AddHours(-24)} | Where-Object {$_.Id -in @(1074,1076,6005,6006,6008)} | Select-Object TimeCreated,Id,LevelDisplayName,Message

4. Look for shutdown events (1074), startup events (6005), or unexpected shutdown indicators (6008)
5. Document the frequency of recovery events using PowerShell:

   Get-WinEvent -FilterHashtable @{LogName='DFS Replication'; Id=5805; StartTime=(Get-Date).AddDays(-30)} | Group-Object {$_.TimeCreated.Date} | Sort-Object Name

Ensure the DFSR service is running properly and check for any configuration issues that might contribute to database problems.

1. Check DFSR service status and startup type:

   Get-Service -Name DFSR | Select-Object Name,Status,StartType,ServiceType

2. Review DFSR configuration and replication group health:

   Get-DfsReplicationGroup | Get-DfsrState -Verbose

3. Check for DFSR database location and available disk space:

   $dfsrConfig = Get-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\DFSR\Parameters"
   $dbPath = $dfsrConfig."Database Directory"
   Get-WmiObject -Class Win32_LogicalDisk | Where-Object {$_.DeviceID -eq (Split-Path $dbPath -Qualifier)} | Select-Object DeviceID,Size,FreeSpace,@{Name="FreeSpaceGB";Expression={[math]::Round($_.FreeSpace/1GB,2)}}

4. Verify DFSR database integrity using built-in tools:

   dfsrdiag dumpmig /rgname:"ReplicationGroupName" /rfname:"ReplicatedFolderName"

5. Check for any pending replication backlog that might indicate ongoing issues:

   dfsrdiag backlog /rgname:"ReplicationGroupName" /rfname:"ReplicatedFolderName" /smem:SourceServer /rmem:DestinationServer

Investigate potential hardware or storage issues that could cause database corruption requiring recovery.

1. Check system event logs for storage-related errors:

   Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=(Get-Date).AddDays(-7)} | Where-Object {$_.ProviderName -match 'disk|storage|ntfs|volsnap'} | Where-Object {$_.LevelDisplayName -match 'Error|Warning'} | Select-Object TimeCreated,Id,ProviderName,LevelDisplayName,Message

2. Run disk health checks on the system volume:

   Get-PhysicalDisk | Get-StorageReliabilityCounter | Select-Object DeviceId,Temperature,PowerOnHours,UnsafeShutdownCount,ReadErrorsTotal,WriteErrorsTotal

3. Check SMART data for storage devices:

   Get-WmiObject -Namespace root\wmi -Class MSStorageDriver_FailurePredictStatus | Select-Object InstanceName,PredictFailure,Reason

4. Verify file system integrity on the system volume:

   chkdsk C: /f /r /x

5. Monitor memory usage and check for memory errors:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=1001} -MaxEvents 50 | Select-Object TimeCreated,Message

Implement measures to prevent unexpected shutdowns and improve monitoring of DFSR database health.

1. Configure Group Policy to prevent forced shutdowns during replication:
   Navigate to Computer Configuration → Administrative Templates → System → Shutdown Options
   Enable "Turn off automatic termination of applications that block or cancel shutdown"
2. Set up DFSR performance monitoring:

   $counterPaths = @(
       "\DFS Replication Service Connections(*)\Total Bytes Received",
       "\DFS Replication Service Volumes(*)\Database Commits",
       "\DFS Replication Service Volumes(*)\Database Lookups"
   )
   Get-Counter -Counter $counterPaths -SampleInterval 60 -MaxSamples 10

3. Create a scheduled task to monitor DFSR health:

   $action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command Get-DfsrState | Out-File C:\Logs\DFSRHealth.log -Append"
   $trigger = New-ScheduledTaskTrigger -Daily -At "02:00AM"
   Register-ScheduledTask -TaskName "DFSR Health Check" -Action $action -Trigger $trigger -Description "Daily DFSR health monitoring"

4. Configure Windows to delay shutdown for DFSR service:
   Modify registry key HKLM\SYSTEM\CurrentControlSet\Control
   Set WaitToKillServiceTimeout to 60000 (60 seconds)
5. Enable DFSR debug logging for detailed troubleshooting:

   wevtutil sl "DFS Replication" /l:5

Perform advanced DFSR database maintenance and optimization to prevent future recovery events.

1. Stop DFSR service and backup current database:

   Stop-Service DFSR -Force
   $dbPath = (Get-ItemProperty "HKLM\SYSTEM\CurrentControlSet\Services\DFSR\Parameters")."Database Directory"
   Copy-Item $dbPath "$dbPath.backup.$(Get-Date -Format 'yyyyMMdd')" -Recurse

2. Perform database compaction to reduce fragmentation:

   esentutl /d "$dbPath\DataBase_GUID.edb" /o

3. Check database integrity and repair if necessary:

   esentutl /g "$dbPath\DataBase_GUID.edb" /v
   esentutl /p "$dbPath\DataBase_GUID.edb" /o

4. Optimize DFSR database settings in registry:
   Navigate to HKLM\SYSTEM\CurrentControlSet\Services\DFSR\Parameters
   Create DWORD MaxLogFileSize with value 67108864 (64MB)
   Create DWORD LogFileCheckpointDepthMax with value 20971520
5. Restart DFSR service and verify operation:

   Start-Service DFSR
   Start-Sleep 30
   Get-WinEvent -FilterHashtable @{LogName='DFS Replication'; Id=@(4102,5002)} -MaxEvents 5

6. Monitor for successful startup and verify no immediate recovery events:

   Get-WinEvent -FilterHashtable @{LogName='DFS Replication'; Id=5805; StartTime=(Get-Date).AddMinutes(-10)} -ErrorAction SilentlyContinue