Force synchronization for DFSR-replicated SYSVOL

One of my clients had a problem with processing GPO on client computers. Different computers applied different settings from the same GPO but from different domain controllers. All tests related to replication was successful, all GPOs are applied, but replication between domain controllers was a problem, and because of that most clients had a different GPO configuration.

I had a similar problem with a newly promoted domain controller which I previously blogged about here.

Scenarios where this problem typically occurs:

• Replication was moved  from FRS to DFSR
• Demoting an old domain controller in the environment
• When there is a problem with the DFS replication of the SYSVOL folder

To solve this problem, I had to manually perform an authoritative synchronization between the domain controllers.

I am including steps for authoritative and non-authoritative synchronization, but before we get started we need to see the state of the replication.

Steps:

1. Find the state of the replication state. Typically the problem DCs will be at 0 or 2. The goal is to get to state 4.
2. Get to State 2
3. Get to State 4

Find the state of the replication of all DCs

0 = Uninitialized
1 = Initialized
2 = Initial Sync
3 = Auto Recovery
4 = Normal
5 = In Error

Non-authoritative synchronization of DFSR-replicated SYSVOL

• Stop the DFS Replication service ( net stop dfsr).
• In the ADSIEDIT.MSC tool modify the following distinguished name (DN) value and attribute on each of the domain controllers that you want to make non-authoritative:
  CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=<the server name>,OU=Domain Controllers,DC=<domain>
  msDFSR-Enabled=FALSE
  
• Force Active Directory replication throughout the domain  ( repadmin /syncall primary_dc_name /APed )
• Run the following command from an elevated command prompt on the same servers that you set as non-authoritative:
  DFSRDIAG POLLAD 
• You will see Event ID 4114 in the DFSR event log indicating SYSVOL is no longer being replicated (Open up event viewer and navigate to Applications and Services Logs -> DFS Replication).
• On the same DN from Step 1, set:
  msDFSR-Enabled=TRUE
  
• Force Active Directory replication throughout the domain ( repadmin /syncall primary_dc_name /APed).
• Start the DFS Replication service ( net start dfsr).
• Run the following command from an elevated command prompt on the same servers that you set as non-authoritative:
  
  MS DOS

  DFSRDIAG POLLAD

  1	DFSRDIAG POLLAD

• You will see Event ID 4614 and 4604 in the DFSR event log indicating SYSVOL has been initialized. That domain controller has now done non-authoritative sync of SYSVOL.
• Run Wmic /namespace:\\root\microsoftdfs path dfsrreplicatedfolderinfo get replicationgroupname,replicatedfoldername,stat and make sure the state is at 4. If it is at 2, it may take some time to reach state 4. Wait a few minutes and try again until all DCs are at state 4.

Authoritative synchronization of DFSR-replicated SYSVOL

1. Find the PDC Emulator (Elevated Command Prompt: netdom query fsmo ) – which is usually the most up to date for SYSVOL contents. Or the server holding all the policies and scripts. Consider this the primary server.
2. Stop the DFS Replication service ( net stop dfsr) on the primary server.
3. On the primary server, In the ADSIEDIT.MSC tool, modify the following DN and two attributes to make authoritative:
   CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=<the server name>,OU=Domain Controllers,DC=<domain>
   msDFSR-Enabled=FALSE
   msDFSR-options=1
   
4. Modify the following DN and single attribute on all other domain controllers in that domain:
   CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=<each other server name>,OU=Domain Controllers,DC=<domain>
   msDFSR-Enabled=FALSE
   
5. Force Active Directory replication throughout the domain and validate its success on all DCs ( repadmin /syncall primary_dc_name /APed). Probably need to run the same command 3-4 times.
6. Start the DFSR service set as authoritative ( net start dfsr) on the primary DC.
7. You will see Event ID 4114 in the DFSR event log indicating SYSVOL is no longer being replicated (Open up event viewer and navigate to Applications and Services Logs -> DFS Replication).
8. On the same DN from Step 1, set:
   msDFSR-Enabled=TRUE
   
9. Force Active Directory replication throughout the domain and validate its success on all DCs ( repadmin /syncall primary_dc_name /APed ). Probably need to run the same command 3-4 times.
10. Run the following command from an elevated command prompt on the same server that you set as authoritative (primary server):
    DFSRDIAG POLLAD 
11. Wait a few minutes you will see Event ID 4602 in the DFSR event log (Open up event viewer and navigate to Applications and Services Logs -> DFS Replication) indicating SYSVOL has been initialized. That domain controller has now done an authoritative sync of SYSVOL.
12. Start the DFSR service on the other non-authoritative DCs ( net start dfsr). You will see Event ID 4114 in the DFSR event log indicating SYSVOL is no longer being replicated on each of them.
13. Modify the following DN and single attribute on all other domain controllers in that domain:
    CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=<each other server name>,OU=Domain Controllers,DC=<domain>
    msDFSR-Enabled=TRUE
    
14. Run the following command from an elevated command prompt on all non-authoritative DCs (i.e. all but the formerly authoritative one):
    
    MS DOS

    DFSRDIAG POLLAD

    1	DFSRDIAG POLLAD

15. Verify you see Event ID 2002 and 4602 on all other domain controllers.
16. Run Wmic /namespace:\\root\microsoftdfs path dfsrreplicatedfolderinfo get replicationgroupname,replicatedfoldername,stat and make sure the state is at 4. If it is at 2, it may take some time to reach state 4. Wait a few minutes and try again until all DCs are at state 4.

After these actions, all problems with GPO processing and SYSVOL replication disappeared. 🙂