Hello. This is David, Principal Engineer with Dell. Today I'm going to talk about
performing a non-authoritative sync of SYSVOL data using Distributed File System Replication,
or DFSR. DFSR is the newer of the two methods used to replicate SYSVOL data in a domain, the older
being File Replication Service or FRS. Most modern domains will be using DFSR to replicate SYSVOL at
this point. It's more robust than FRS but it can still break, and sometimes it's necessary to force
synchronization between domain controllers. In this video I'm going to show you how to
perform a non-authoritative sync in which our target domain controller copies the SYSVOL data
from another DC. In our environment we have two DCs that we're going to be concerned with here,
‘DC1’ and ‘DC3’. DC1 will be our source DC and DC3 will be our target. If we open Event Viewer on DC3
and look in the ‘DFS Replication’ log we can see errors. In this case the specific errors are not
important. I intentionally broke DFSR for this demonstration, but what we can tell here is that
DFS replication is not functioning correctly. It has not been replicating SYSVOL data from
another domain controller as it should. If we look at Event Viewer on DC1 we see no errors,
just informational events. There are some errors a little while back but they have been cleared up
and DFSR on DC1 is functioning properly. So, the only issue here is on DC3. We can confirm that
there is an issue if we go into Group Policy Management’, and take a look at the number
of GPOs we have here. There are 10 including three ‘Test GPO’s that were created recently
for purposes of this demonstration. If we look in the SYSVOL content folder we see 10 folders
in here under ‘SYSVOL’, ‘domain’, ‘policies’. Each one of those folders contains the template
files for each of the GPOs that we saw in the ‘Group Policy Management’ console. So, since we
have 10 GPOs we have 10 folders with template files. If we go to the same location on DC3,
browse to ‘Windows’ then ‘SYSVOL’ , ‘domain’, and ‘policies’ we see only seven folders. Here the
three test GPOs that I created recently have not been replicated, so their template files
are not present on DC3, indicating once again a problem with DFS replication of the SYSVOL data.
Now, in order to correct this, we will perform a non-authoritative sync of SYSVOL. To do that
we'll run ‘adsiedit’ and within ADSI Edit we will connect to the ‘Default naming context’.
Leave all these values at their defaults and this will connect us to the default naming
context. Under here we will expand the ‘Default naming context’, then expand the domain expand
the domain controllers ‘OU’, and DC3 is the only one we'll be concerned with here so we'll expand
‘DC3’ and expand ‘DFSR-localSettings’ and expand ‘Domain System Volume’,
and here we see the SYSVOL subscription object. We'll edit this object to take a look at its
attributes here, and the attribute that we're concerned with is called ‘msDFSR-Enabled’. We want
to set that to ‘False’, click ‘OK’ to confirm and ‘OK’ again. Since we actually performed
this change on DC3, and DC3 is the only domain controller we're concerned with at the moment,
we don't need to force replication. That attribute is stored in Active Directory,
but we're only concerned about the value on DC3. What we do need to do is run ‘dfsrdiag pollad’
which tells DFSR to query Active Directory for any configuration changes. We see here
that the command succeeded, so we'll go back to Event Viewer and refresh, and it'll show
couple of informational events ‘4114’ and ‘2010’ indicating that DFS replication has been disabled.
‘4114’ specifically refers to the SYSVOL path and ‘2010’ just refers to DFS replication overall,
since all of the replicated folders have been disabled. So now that we've done that,
we go back to the same attribute in ANSI edit, and set it back to ‘True’. Click ‘OK’ to confirm and
‘OK’ again. Once again we don't need to replicate, we do need to run ‘dfsrdiag pollad’ again,
since we made an another configuration change. Once again the command succeeds,
and we go back to Event Viewer and refresh once more, and now we see a warning event.
‘4614’. ‘The DFS replication service initialized SYSVOL at local path (SYSVOL path) and is waiting
to perform initial replication.’, and quickly we see that there are new events again. If we
refresh again we see event ‘4604’ which is what we're looking for. ‘The DFS replication server
successfully initialized the SYSVOL replicated folder’ at the path ‘This member has completed
initial synchronization of SYSVOL with partner dc1’ and it says to check for the SYSVOL folder.
We run the ‘net share’ command, and that confirms that we do have ‘SYSVOL’ and ‘NETLOGON’ shares,
and if we go back to file explorer we see now that there are 10 folders containing
GP template files. That also confirms that the SYSVOL data has replicated from DC1.
If we go back to DC1 we can compare those folders and confirm that they are the same.
So that, once again, was a non-authoritative sync of SYSVOL using DFSR. My name is David,
and I'm a principal engineer at Dell. Thank you for watching.