Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
ntfrs.exe is the executable used by Windows Server’s legacy File Replication Service (FRS). FRS replicated SYSVOL policy and logon-script data, and in some older environments DFS files, between domain controllers and other servers. Microsoft deprecated FRS and requires modern domains to move SYSVOL replication to DFS Replication (DFSR).
The filename alone cannot prove that a copy is safe. On a server that still uses FRS, a genuine ntfrs.exe may be legitimate; a copy launched from a user-writable or unexpected folder, lacking a valid Microsoft signature, or running without the File Replication Service registration deserves investigation. The correct fix depends on the event ID: DNS and partner failures, disk exhaustion, database corruption and persistent replication states each require different steps.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
What does ntfrs.exe do?
ntfrs.exe is the process associated with File Replication Service. Microsoft describes FRS as a multi-threaded, multi-master replication engine. Older Windows 2000 and Windows Server 2003 domains used it to replicate the SYSVOL tree, which contains Group Policy data and logon scripts. Some legacy deployments also used FRS for Distributed File System (DFS) replica sets.
FRS is primarily a domain-controller and server technology. A normal Windows 10 or Windows 11 gaming PC should not need it simply because a file with that name exists. Confirm the service registration and the file’s signature before assuming that the copy belongs to Windows.
Popular on Amazon
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
FRS identifies replicated files and folders by globally unique identifiers (GUIDs), not only by their visible names. That design explains why a conflict can produce a folder name containing _NTFRS_ followed by eight hexadecimal characters: FRS is preserving both versions when their GUIDs differ.
Is ntfrs.exe safe or a virus?
A genuine Microsoft FRS executable can be safe, but a process name is not proof of authenticity. A third-party process directory identifies ntfrs.exe as the Windows File Replication Service, while Microsoft’s own guidance focuses on the service and replication role rather than declaring every file with that name trustworthy.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsUse this local verification sequence when the process appears unexpectedly:
- Identify the owner. In Task Manager, right-click the process and choose Open file location. In the Services console, look for File Replication Service and check whether it is the service associated with the process.
- Inspect the file location. A copy in a temporary, Downloads, or user-profile directory is suspicious until proven otherwise. The expected location is release- and installation-specific; there is no single universal path that applies to every Windows Server version.
- Check the signature. Open the file’s Properties, select Digital Signatures, and verify that the signature is present and valid for Microsoft. An absent or invalid signature is a reason to stop treating the file as trusted.
- Scan the file and the system. Run the full scan supplied by your installed security product if the signature is missing, the name is misspelled, or the process starts outside the registered service.
- Do not delete first. On a domain controller or legacy server, removing the executable can interrupt SYSVOL or other replica sets. Establish whether the computer still participates in FRS before changing files.
These checks establish what is running on your computer; they cannot be completed from the filename alone. If the process is unsigned, runs from an unexpected directory, or returns after removal, involve your security and domain-administration teams rather than manually replacing system files.
Can I delete ntfrs.exe?
Do not delete ntfrs.exe as a first-line fix. If the server still uses FRS, deleting it can prevent the service from starting and leave SYSVOL or other replica data out of date. Even where FRS is no longer needed, removal should be part of a planned server decommissioning or migration, not a file-cleanup exercise.
On an ordinary client PC, first prove that the file is unrelated to a registered Windows service and validate it with a security scan. Quarantining an unsigned copy through your security product is safer than deleting a potentially legitimate server component by hand.
Also popular on Amazon
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Why is ntfrs.exe using CPU or disk?
FRS can consume resources while it scans, stages, or retries replication, but sustained activity is usually a symptom to diagnose rather than a reason to kill the process. Check the event log and identify the event ID before changing service settings. Network failures can cause repeated retries; a full replica volume can stop progress; and a damaged database can leave the service in an error state.
On a client edition of Windows where no File Replication Service is registered, a similarly named process should be treated as an identity problem first. Verify the owning service, path, signature and scan results before investigating performance.
Which ntfrs.exe event ID is showing?
Event IDs narrow the repair. The following Microsoft-documented conditions map the common FRS errors to the first action to take.
| Event ID | Meaning | First corrective action |
|---|---|---|
| 13508 | FRS cannot communicate with a replication partner; DNS resolution, a stopped partner service, or incomplete Active Directory topology can be responsible. | Verify both servers are online, confirm DNS, check that the partner runs FRS, and test connectivity. |
| 13510 | A partner or communication problem is preventing replication. | On the partner, run net start ntfrs after confirming the machine is available; use ping, ipconfig and nslookup to isolate connectivity and DNS issues. |
| 13511 | The volume containing a replica path has no free space. | Restore free space on that volume, then start FRS. |
| 13513 | FRS reports a database-corruption condition. | Protect a system-state backup, follow change control, repair the database with the documented ESENT command, then start FRS. |
| 13555 | FRS is in a persistent error state and files cannot replicate. | Try a controlled stop/start; if the state remains, perform the appropriate authoritative or non-authoritative system-state recovery. |
How do I fix event 13508 or 13510?
These events point to communication with a replication partner. Correct the underlying availability, DNS, or Active Directory topology issue before repeatedly restarting the service.
- Confirm that the local server and the named partner are powered on and reachable.
- On each machine, use
ipconfigto review addressing and DNS configuration. Usenslookupto verify that each server name resolves to the intended address. - Test basic reachability with
ping. A failed test indicates a network or name-resolution problem that must be resolved before FRS can communicate. - On the partner, open an elevated Command Prompt and run
net start ntfrsif the File Replication Service is stopped. - After correcting DNS or partner availability, restart the local service with
net stop ntfrsfollowed bynet start ntfrs. - Review new events and confirm that replication resumes. If the same error returns, check whether Active Directory topology changes have reached all domain controllers; incomplete topology replication is a documented cause of event 13508.
Do not use a service restart to mask a persistent DNS or topology failure. The restart only causes FRS to retry the same communication.
How do I fix event 13511 when the disk is full?
Event 13511 means FRS stopped because the volume containing a replica path had no free space. Identify the affected volume from the event details, then reclaim or provision space according to your organization’s storage policy.
Also popular on Amazon
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
- Check free space on every volume used by the replica set, not only the system volume.
- Restore sufficient free space using approved storage or cleanup procedures. Do not delete replica data, staging folders, or SYSVOL content merely to make the number larger.
- Once the volume is healthy, start the service with
net start ntfrs. - Watch the event log for a successful restart and for any follow-up replication errors.
If the volume repeatedly fills, treat capacity planning and replica-set design as the underlying issue instead of repeatedly restarting FRS.
How do I repair an event 13513 database-corruption error?
Event 13513 indicates that the FRS database is considered corrupt. Database repair on a domain controller can affect replication, so preserve a current system-state backup and follow your organization’s change-control process before proceeding.
Recommended Free Tools
- Record the event details and identify the FRS database path on the affected server.
- Ensure the service is stopped and that you have a restorable system-state backup.
- Run the Microsoft-documented ESENT defragmentation command, substituting the actual database path:
esentutl /d <database-path>. - Confirm that the command completes successfully, then start FRS with
net start ntfrs. - Check replication events and SYSVOL health. If corruption remains, stop and obtain domain-administration assistance rather than repeatedly running repair commands.
The command repairs the database structure; it does not decide which copy of conflicting replicated data should be authoritative.
How do I recover from event 13555?
Event 13555 leaves files unable to replicate until recovery is performed. A controlled stop and start may clear a temporary state:
- Run
net stop ntfrs, wait for the service to stop, and runnet start ntfrs. - Review the next events. If 13555 returns, stop making ad-hoc registry or folder changes.
- Determine whether another healthy domain controller or replica partner has the authoritative copy of the data.
- Use the documented authoritative or non-authoritative system-state restoration procedure that matches that topology. Authoritative recovery publishes the selected server’s data; non-authoritative recovery obtains a fresh copy from a healthy partner.
This is a domain-administration operation, not a consumer cleanup task. If SYSVOL or Group Policy is involved, have an administrator who manages Active Directory perform or supervise the recovery.
What does a folder ending in _NTFRS_ mean?
FRS appends _NTFRS_ and eight hexadecimal characters when an incoming change would create a name conflict with an existing folder whose GUID differs. The suffix is expected conflict handling, not by itself evidence of malware.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Also popular on Amazon
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Compare the conflicting contents and GUID-related metadata with your replication policy before deleting either folder. Preserve the copy required by the authoritative server or application, and document the decision so the same conflict is not recreated during recovery.
Should I migrate from FRS to DFSR?
Yes, if the domain still uses FRS for SYSVOL, plan a migration to DFSR. Microsoft deprecated FRS and identifies Windows Server 2016 as the initial release ending NTFRS support; newer domain-controller promotion requires DFSR-based SYSVOL replication.
The migration utility, dfsrmig.exe, is installed with the DFS Replication service. It reports four domain migration states:
| State | Value | What it represents |
|---|---|---|
| Start | 0 | The domain still begins SYSVOL replication with FRS. |
| Prepared | 1 | DFSR has prepared the replicated SYSVOL structure. |
| Redirected | 2 | SYSVOL access is redirected to the DFSR-replicated location. |
| Eliminated | 3 | FRS is removed from SYSVOL replication. |
- Inventory every domain controller, its operating-system version, current FRS events, SYSVOL state and available system-state backups.
- Resolve DNS, partner, disk and database errors before beginning migration. A domain that cannot replicate reliably is not ready for a technology transition.
- Read the current migration state with the Microsoft-documented
dfsrmig.exeprocedures on the appropriate domain controller. - Advance through Start, Prepared, Redirected and Eliminated only according to Microsoft’s migration guidance, verifying convergence at each stage.
- Do not improvise registry edits or force a state on a production domain controller. A failed migration can affect Group Policy and logon processing across the domain.
For new DFSR deployments, Microsoft’s current installation guidance covers Windows Server 2016, 2019, 2022 and 2025. DFSR requires NTFS; it does not support ReFS, FAT or Cluster Shared Volumes for replicated folders.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What is the difference between FRS and DFSR?
FRS is retained for compatibility with older domains, while DFSR is the supported path for modern SYSVOL replication. The practical choice is not a performance-shopping decision: it is whether a legacy domain needs controlled migration to a supported service.
| Area | FRS | DFSR |
|---|---|---|
| Primary role | Legacy replication for SYSVOL and some older DFS replica sets. | Modern Windows Server replication service used for supported deployments and SYSVOL migration. |
| Microsoft status | Deprecated; NTFRS support ends with the Windows Server 2016 generation for new domain-controller scenarios. | Supported migration target; current installation guidance covers Windows Server 2016, 2019, 2022 and 2025. |
| Migration tool | Source service during SYSVOL migration. | dfsrmig.exe performs the staged move from FRS. |
| Replicated-folder file system | Existing legacy deployments vary by server and replica design. | Requires NTFS and does not support ReFS, FAT or Cluster Shared Volumes for replicated folders. |
When should I call a Windows or domain administrator?
Get specialist help before changing a domain controller when any of these conditions apply:
Also popular on Amazon
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
- The process is unsigned, misspelled, or launched from a user-writable directory.
- SYSVOL, Group Policy, logon scripts, or multiple domain controllers are affected.
- Event 13513 or 13555 persists after the documented first steps.
- You lack a verified system-state backup.
- You are considering authoritative recovery, registry edits, or a domain-wide FRS-to-DFSR migration.
For a single server, give the administrator the event ID, affected volume, partner names, DNS test results, service status and signature findings. That information is more useful than simply reporting that “ntfrs.exe crashed.”
If you want an optional shortcut after trying the manual checks, Outbyte PC Repair can address more than 100 common Windows issues, clean temporary and cache files, check selected Windows settings and missing updates, provide an app-crash log and other maintenance tools, and run on Windows 11, 10, 8 and 7. It complements an antivirus rather than replacing one; results vary, and no tool repairs every crash. A category-based free trial lasts at least two days before a paid subscription.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchFrequently asked questions
Will ntfrs.exe normally run on a Windows 11 gaming PC?
Windows 11 client editions do not normally participate in an FRS domain replication set. If the process appears there, verify the owning service, file location, Microsoft signature and security-scan results instead of assuming it is a required gaming component.
Is it safe to restart FRS during business hours?
Restarting the service temporarily stops replication and can delay SYSVOL or logon-script updates. Coordinate the action with the domain administrator, especially when several domain controllers show partner errors or when Group Policy changes are being deployed.
What if event 13508 returns after DNS tests pass?
Successful name resolution does not prove that the partner service is running or that Active Directory topology has converged. Check the partner’s FRS status and recent directory-replication changes, then escalate if the same event continues.
Does an _NTFRS_ folder name mean my files are infected?
No. FRS creates that suffix for a GUID conflict between replicated folders. Review the two copies and your authoritative-data policy; use a security scan only when other evidence, such as an unsigned executable or unexpected launch location, indicates a separate security concern.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Frequently Asked Questions
Will ntfrs.exe normally run on a Windows 11 gaming PC?
Windows 11 client editions do not normally participate in an FRS domain replication set. If the process appears there, verify the owning service, file location, Microsoft signature and security-scan results instead of assuming it is a required gaming component.
Is it safe to restart FRS during business hours?
Restarting the service temporarily stops replication and can delay SYSVOL or logon-script updates. Coordinate the action with the domain administrator, especially when several domain controllers show partner errors or when Group Policy changes are being deployed.
What if event 13508 returns after DNS tests pass?
Successful name resolution does not prove that the partner service is running or that Active Directory topology has converged. Check the partner’s FRS status and recent directory-replication changes, then escalate if the same event continues.
Does an _NTFRS_ folder name mean my files are infected?
No. FRS creates that suffix for a GUID conflict between replicated folders. Review the two copies and your authoritative-data policy; use a security scan only when other evidence, such as an unsigned executable or unexpected launch location, indicates a separate security concern.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
