Dear Sysadmin, after searching for 6 hours manuals of MS website, this 10 min video saved my live! Thank you so much. All works as expected. I can add only 1 note from my end. When new DC controller is set-up and replication is not working: 1) Proceed all steps in video 2) If no "Netlogon" and no "Sysvol" shares are available on problematic (New) DC, go to registry and change HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters "SysvolReady" to 1 Restart "Netlogon" service If no replication is started and no files created under "Sysvol", create manually directory "Sysvol\Polices" and sync will work as expected Thanks
YOU ARE A GAWD. I'm an MCSA on Server 2016, ten years professionally doing this stuff, set up a new DC today and ran into this issue. With the move to the cloud, I don't touch servers a ton anymore, but wow did this fix the issue. I was totally lost, too.
Life saver! I had an issue where de-promoting the old secondary DC caused the old primary DC to crap itself, and the new DCs took over but had weird issues because it wasn't graceful at all. You've just helped me solve the biggest issue that's been plaguing my domain!
This is one of the best instructional videos I have seen. Great explanations as to why you're doing what you're doing and what it's supposed to fix and how to do it. Fantastic!
Been on this thing for 3 days and this fixed 95% of the problems I was having (the other was Netlogon folder missing). Thanks for posting such a clean fix! Thankfully I did all of this on actual copies of may production machines in a VMware Workstation environment. This would have been a major PITA if not. 1000 Thank You's!
The steps in this video worked like a charm, I'd added a 2019 DC to a 2016 domain running a single DC but noticed no sysvol or netlogon on the new box. Did these steps and replication was fixed.
Thanks for this video. I have done it in the last six months or so on another DC pair, but this helped me out today when I needed to get this done in a hurry for a customer. Good clear instructions and fixed up a DFS system that had been broken for a long while. Top stuff!
Hello Sysadmin, That worked perfectly for my issue where I had three domain controllers and migrated the FSMO roles to DC1. When I changed a policy, it didn't fully replicate to the SYSVOL, which was weird because it replicated to DC2, but when I navigated to the domain\sysvol on DC1, it was not there! Really weird! Anyway, it solved my issue. Thank you.
Worked for me , awesome and concise explanation. Only thing at the end I was wondering what happened to dsrf-options value which wasn’t manually reverted to original but in my case once everything was consistent again and working the value itself got back to 0
Thanks for this video. I had an issue where I have upgraded from a SBS 2008 server years ago and must have created a DFS group for SYSVOL during the migration. The SBS environment was always a single DC (yes, not good) so I just got around to adding a second DC but the wizard never created the shares or the DFR sync due to a stale sync of over 786 days The steps shown here resolved the issue with the sync once I manually added the shares on the second DC. Thanks again
Great stuff! This is very useful when you need to follow such procedure and don't have time to digest all the steps by simply reading MS article. Thanks man.
Thanks so much! I found a client had a netlogon/sysvol replication issue. Looked like it was also impacting all AD replication (GPO et al) but your procedure here fixed everything.
Very to-the-point video sir. Appreciate for your effort and passing of knowledge. Quick question, how can I intentionally break replication so I can practice this in home lab environment? Any senior AD admin can advise. I am trying to improve my AD troubleshooting skills.
Amazing! It worked like a charm. Thanks a lot for the video - other guides (including the ones from Microsoft) show a bit different actions and they did not work for me.
So your saying a value of 1 is essentially saying the main server is the PDC. That conflicts with information I was able to find on the web. If the "msDFSR-Options" attribute on your Primary Domain Controller (PDC) is set to 1, it means that the PDC is in non-authoritative restore mode for the Distributed File System Replication (DFS-R) service. In this mode, the PDC will discard its current local version of the replicated folders and sync fresh data from other members of the replication group. The other domain controllers (DCs), having "msDFSR-Options" set to 0, are in normal mode. They will continue their regular DFS-R operations and will not discard their current data. In this scenario, the PDC will essentially become a "learner" and will pull the DFS-R data from the other DCs. It will not push any of its DFS-R data to the other DCs. This configuration is typically used when the data on the PDC has become inconsistent or corrupted, and you want to replace it with a fresh copy from the other DCs. However, it's important to note that this operation can generate significant network traffic and should be planned accordingly. Remember, changes to the "msDFSR-Options" attribute should be made with caution, as they can have significant impacts on your DFS-R environment. Always make sure to have a backup and plan before making changes to your DFS-R configuration.
Really appreciate this, I found the same process in a Microsoft guide but being able to watch someone do it was re-assuring, thank you! One quick question, I've followed this process as a newly promoted DC wasn't syncing. I plan to remove the current DC, would I have to manually update the option from 1 to 0 again when transferring the roles?
Thank you for great guide! Does this also work on a more complicated scenario where there are two child domains? Root-DC1 Root-DC2 / Child-DC1 Child-DC2 / Child2-DC1 Child2-DC2. I have a replication issue with Root-DC2 , even the initial replication is not done after dcpromo, there are no sysvol and netlogon shares. Non-authoritative restore did not work. I am a little afraid to do Authoritative restore, as most instructions say you have to change msDFSR-Enabled = False on all DC's.
The problem I am having is that the Netlogon and Sysvol folder is not on the additional DC. Yet it tells me the replication is working when I run the command to test it.
What if I am facing DNS replication issue? Any tips how to diagnose that? I dont see any warnings/errors in the event log for the DNS server service, apart from 4013 which doesn't really mean anything because then it says it loaded the zones few seconds after.
Without knowing your setup or seeing any errors I would probably start here: www.dell.com/support/article/en-us/sln156253/troubleshooting-active-directory-and-dns-replication
What if there is only one domain controller and you are getting event ID 4012 DFS Replication. How would I go about fixing this when there is only one domain controller and old domain controller was decommissioned.
what if NONE of the DCs have msDFSR-Options = 1 on them? Yet, we do have one designated as the Operations Master according to the ADUC GUI? Is that completely separate from DFSR?
If I have only 1 problematic server, then I have to change the DFSR to false only on it, or on all DCs in the whole domain? (Master server part is clear)
I experienced this identical issue at work and these steps resolved the replication issue perfectly, but I don't know what caused the issue to begin with. How did you set up your lab to have this issue, as I would like to understand what causes this?
when u say ur logon scripts are not working how u updated it and logonscripts are store in netlogon folder so the entire trblshooting u did was was netlogon folder I mean im not getting what is the actual connection between netlogon and sysvol folder
Dear Sysadmin, after searching for 6 hours manuals of MS website, this 10 min video saved my live! Thank you so much. All works as expected. I can add only 1 note from my end. When new DC controller is set-up and replication is not working:
1) Proceed all steps in video
2) If no "Netlogon" and no "Sysvol" shares are available on problematic (New) DC, go to registry and change
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
"SysvolReady" to 1
Restart "Netlogon" service
If no replication is started and no files created under "Sysvol", create manually directory "Sysvol\Polices" and sync will work as expected
Thanks
Even if this does not fix my particular problem. This is the best explanation of an issue I have ever seen on TH-cam.
YOU ARE A GAWD. I'm an MCSA on Server 2016, ten years professionally doing this stuff, set up a new DC today and ran into this issue. With the move to the cloud, I don't touch servers a ton anymore, but wow did this fix the issue. I was totally lost, too.
Been beating my head against my desk all day trying to figure this out. This video worked. Thank you much, sir!
I can't say how much this tutorial is great.
Right to the point, perfect. Thank you!
Life saver! I had an issue where de-promoting the old secondary DC caused the old primary DC to crap itself, and the new DCs took over but had weird issues because it wasn't graceful at all. You've just helped me solve the biggest issue that's been plaguing my domain!
This is one of the best instructional videos I have seen. Great explanations as to why you're doing what you're doing and what it's supposed to fix and how to do it. Fantastic!
Been on this thing for 3 days and this fixed 95% of the problems I was having (the other was Netlogon folder missing). Thanks for posting such a clean fix! Thankfully I did all of this on actual copies of may production machines in a VMware Workstation environment. This would have been a major PITA if not. 1000 Thank You's!
I can't tell you how glad I am to have found this -- I've been stuck on this for way too long that I'm willing to admit! Thank you.
The steps in this video worked like a charm, I'd added a 2019 DC to a 2016 domain running a single DC but noticed no sysvol or netlogon on the new box. Did these steps and replication was fixed.
Thank you so much .... just tested in the lab and resolved all my issue straight forward ... Man of the day !!
I cant thank you enough for creating this video. We have had so many replication issues and this fixes them. THANK YOU!
Hi Sysadmin....you are a life saver!!!!!!!! Thank you so much! This is the easiest to follow and most accurate resolution!
Thanks for this video. I have done it in the last six months or so on another DC pair, but this helped me out today when I needed to get this done in a hurry for a customer. Good clear instructions and fixed up a DFS system that had been broken for a long while. Top stuff!
Just wanted to say thank you, this got my SYSVOL rep working straight away following this guide.
I've been chasing this problem for two weeks. Good thing I caught the problem in a test lab. Thank you!
In 2024, the issue with DC Server 2016 has been resolved.
Thank you very much.
I had 2 situations were it help me a lot! I have no words to thank you man!
Excellent, clear and concise walkthrough. Very much appreciated.
Hello Sysadmin,
That worked perfectly for my issue where I had three domain controllers and migrated the FSMO roles to DC1. When I changed a policy, it didn't fully replicate to the SYSVOL, which was weird because it replicated to DC2, but when I navigated to the domain\sysvol on DC1, it was not there! Really weird! Anyway, it solved my issue. Thank you.
I love it when videos get straight to the point and work. Awesome job!
Fantastic video. I do not comment on things at all but this has saved me so much. Just subscribed. Keep up the awesome work bud!
Worked for me , awesome and concise explanation. Only thing at the end I was wondering what happened to dsrf-options value which wasn’t manually reverted to original but in my case once everything was consistent again and working the value itself got back to 0
Thank you very much this fixed my issue and i cant tell you how long it took me of trying before i found this video
Saved me countless hours of troubleshooting, thanks a lot.
You just helped me fix the issue and I did find another article on how to do this but the video was much better.
Thank you Paul! Saved the Easter Weekend! :-)
Thanks for this video. I had an issue where I have upgraded from a SBS 2008 server years ago and must have created a DFS group for SYSVOL during the migration.
The SBS environment was always a single DC (yes, not good) so I just got around to adding a second DC but the wizard never created the shares or the DFR sync due to a stale sync of over 786 days
The steps shown here resolved the issue with the sync once I manually added the shares on the second DC.
Thanks again
Great stuff!
This is very useful when you need to follow such procedure and don't have time to digest all the steps by simply reading MS article.
Thanks man.
Thanks so much! I found a client had a netlogon/sysvol replication issue. Looked like it was also impacting all AD replication (GPO et al) but your procedure here fixed everything.
Thanks. This solved my issue. Had 3 DC´s that did not sync at all. And now it works again.
Not all heroes wear capes. You sir are great!
Thank you!
Thx Paul, you saved us as lot of time :)!!
Very to-the-point video sir. Appreciate for your effort and passing of knowledge. Quick question, how can I intentionally break replication so I can practice this in home lab environment? Any senior AD admin can advise. I am trying to improve my AD troubleshooting skills.
Thanks a bunch! This video helped me solve my problem! Thank you so much mate.
You just got a new subscriber!
This solved my domain sysvol replication issues. Thanks for a great video guide :)
Really helpful. resolved my GPO replication issue. Thanks a lot
Can't thank you enough. This fixed my DFS replication issues.
Thanks bro so much as I was fighting with this case for 3 straight days. xxx
You rock Bro, fantastic tutorial. Hit every step, easy to follow and fixed my issue!
Subscribed! this is the very first video I found very useful lol. Thanks very much.
This was the perfect tutorial, I was able to fix this issue finally. Thanks!😀
Thank you thank you thank you You saved me two days worth of headache just a discover this was the issue
Thank you so much, been stuck on this for way too long! 🙏
Great help! I couldn't follow step by step because there was a difference in my configuration but it worked great!
Fantastic, thank you for this. It sorted my issue with two DC's not replicating.
WOW - Super Useful - seems to be a far to frequent issue. saved many hours (after many hours) of headache!!
Super well done tutorial! Very clear and concise. Thank you so much for making this video! You saved me a LOT of time and worry.
The best video on TH-cam. Thank you so much man.
Thank you mate for taking the time to watch. I’m glad it was helpful.
Thanks for this video, following your steps I just resolved problem on my client's DC.
Thank you very much!! Everyhthing perfect for me. Greetings from Spain!
Thanks for the insight. This didn't resolve my issue, but I was able to resolve one item that was helpful.
You are the best. Thank you so much for this video. I can't say how thankfull I am.
Amazing! It worked like a charm. Thanks a lot for the video - other guides (including the ones from Microsoft) show a bit different actions and they did not work for me.
I have been trying to fix this shit for hours, video saved me, THANK YOU!
You're a life saver, subscribed
Thank you so much! this video gave me a good idea to troubleshoot the domain controller sync issue.
Thank you so much for your assistance and clear explaination in this video
So your saying a value of 1 is essentially saying the main server is the PDC. That conflicts with information I was able to find on the web.
If the "msDFSR-Options" attribute on your Primary Domain Controller (PDC) is set to 1, it means that the PDC is in non-authoritative restore mode for the Distributed File System Replication (DFS-R) service. In this mode, the PDC will discard its current local version of the replicated folders and sync fresh data from other members of the replication group.
The other domain controllers (DCs), having "msDFSR-Options" set to 0, are in normal mode. They will continue their regular DFS-R operations and will not discard their current data.
In this scenario, the PDC will essentially become a "learner" and will pull the DFS-R data from the other DCs. It will not push any of its DFS-R data to the other DCs.
This configuration is typically used when the data on the PDC has become inconsistent or corrupted, and you want to replace it with a fresh copy from the other DCs. However, it's important to note that this operation can generate significant network traffic and should be planned accordingly.
Remember, changes to the "msDFSR-Options" attribute should be made with caution, as they can have significant impacts on your DFS-R environment. Always make sure to have a backup and plan before making changes to your DFS-R configuration.
Excellent explanation with good efforts...
Thanks, I appreciate your effort and a great video. I have another issue is the Netlogon folder is missing for additional DC.
Thank you! Thank you! Thank you! This solved our replication problems!🎉
By just watching this video without doing anything, all DFSR issues got fixed ;p
Worked like a charm! Brilliant!
I know this is an older video, but any ideas when I'm getting a RPC server is unavailable error when running the replication commands?
Really appreciate this, I found the same process in a Microsoft guide but being able to watch someone do it was re-assuring, thank you! One quick question, I've followed this process as a newly promoted DC wasn't syncing. I plan to remove the current DC, would I have to manually update the option from 1 to 0 again when transferring the roles?
Thank's for this nice tutorial, easy to understand it solved my problem :)
Thank you, that helped me with an ongoing problem :)
Worked like a charm!. Thank You so so much!
Thank you very much for helping. This resolve my Problem with four DCs.
Thank you for great guide! Does this also work on a more complicated scenario where there are two child domains? Root-DC1 Root-DC2 / Child-DC1 Child-DC2 / Child2-DC1 Child2-DC2. I have a replication issue with Root-DC2 , even the initial replication is not done after dcpromo, there are no sysvol and netlogon shares. Non-authoritative restore did not work. I am a little afraid to do Authoritative restore, as most instructions say you have to change msDFSR-Enabled = False on all DC's.
Great Video! We had the same problem and could fix it with your help. Thanx a lot.
nice. what if you have more than 2 domain controllers? do you have to disable the DFSR on all? thank you for this
"and one days someone come in the use of it"
here is that one day .
thanks alot
very spot on! works flawlessly! Kudos!
The problem I am having is that the Netlogon and Sysvol folder is not on the additional DC. Yet it tells me the replication is working when I run the command to test it.
So easy and so damned helpful!! Subscribed.
Great Video, that helped me so much. Thx
Thanks for this Tutorial, you're the best:)
What if I am facing DNS replication issue? Any tips how to diagnose that? I dont see any warnings/errors in the event log for the DNS server service, apart from 4013 which doesn't really mean anything because then it says it loaded the zones few seconds after.
Without knowing your setup or seeing any errors I would probably start here: www.dell.com/support/article/en-us/sln156253/troubleshooting-active-directory-and-dns-replication
What if there is only one domain controller and you are getting event ID 4012 DFS Replication. How would I go about fixing this when there is only one domain controller and old domain controller was decommissioned.
Thank you very much! This is the best videp I ever seen!
Thanks for the feedback
why wouldn't you do a non-auth restore and it will copy changes from dc02? what is the reasoning behind doing a auth restore in this scenario -thanks
Thanks mate. Really helped me out here!
Thank you! This video helped me out and saved the day!
what is the default msDFSR-Options = 1 on DCs, once the replication is fixed, shouldnt it be reverted on all DCs to default ? please advise.
what if nothing is syncing either way? follow the same stuff, or is there another way to approach it if no replication is happening whatsoever?
what if NONE of the DCs have msDFSR-Options = 1 on them? Yet, we do have one designated as the Operations Master according to the ADUC GUI? Is that completely separate from DFSR?
If I have only 1 problematic server, then I have to change the DFSR to false only on it, or on all DCs in the whole domain? (Master server part is clear)
I experienced this identical issue at work and these steps resolved the replication issue perfectly, but I don't know what caused the issue to begin with. How did you set up your lab to have this issue, as I would like to understand what causes this?
Very good explanation. thanks
Dude you are the GOAT!!!
Thank you! Very helpful! Saved my day!!!!!!!!!!!!!!!!!!!!!😘
when u say ur logon scripts are not working how u updated it and logonscripts are store in netlogon folder so the entire trblshooting u did was was netlogon folder I mean im not getting what is the actual connection between netlogon and sysvol folder
thank you, worked like a charm!
Thank you very much ...really amazing video.
Very useful video.Thanks !!!
Great video - well communicated !!
We Had a major power outagelast week- both DC's went downfor hours, and when they came up - DC2 had NetLogon disabled. This should work right?
I do not have msDFSR-Enabled at all on my domain controllers... it is not there... 2012R2... not sure how to proceed..