Missing SYSVOL & NETLOGON after domain controller promotion

Recently I found an issue with a newly promoted domain controller missing the SYSVOL and NETLOGON shares. Most of the cases it would also be a new domain controller for an existing or new forest. In most cases, you would need to update the flag below.

Open Regedit
Browse to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters Set SysVolReady  from 0 to 1
Close Regedit

This will create the SYSVOL share. If the NETLOGON share is not created you would need to create the folder scripts in C:\Windows\SYSVOL\domain\. When this is done, restart the NETLOGON service.

This is the easy part. In some cases, although the NETLOGON and SYSVOL shares are working, no group policies or scripts are being replicated using the DFSR. I have post talking about this issue in detail here.

We can verify the replication by running the following command.

The states should translate as below

0 = Uninitialized
1 = Initialized
2 = Initial Sync
3 = Auto Recovery
4 = Normal
5 = In Error

In my case, I have noticed that the newly promoted server was showing 2 and the primary domain controller was showing “No Instance(s) Available” which is quite strange.

Here you would need to look into the original Active Directory server for any problems and you would see a warning on the DFS Replication under Applications with Event ID 2213 as below.

It says that the DFS Replication service stopped replication on volume C:. This occurs when a DFSR JET database is not shut down cleanly and Auto Recovery is disabled.

What we need to do here is from the event viewer take note of the volumeGUID and run the below command and replacing GUID-NUMBER with your GUID.

This will restart the replication and recreate the database. This can be seen with an event with ID 2214 saying The DFS Replication service successfully recovered from an unexpected shutdown on volume C. This can occur if the service terminated abnormally (due to the VM shutting down incorrectly, for example) or an error occurred on the volume. No user action is required.

If you run the command again to see the state of the replication you will see that the servers are all showing state 4 as below and both SYSVOL and NETLOGON will be replicated.