FRS to DFRS Migration

Question

Hi All,

We are planning to upgrade 2008 R2 domain controllers, As a part of this upgrade process, We have deployed new windows 2016 servers and promoted them as the additional domain controllers without FRS to DFRS Migration.

a .) Now the issue is, Both Netlogon and SysVol folder is missing in windows 2016 domain controllers. I have applied the below registry key in windows 2016 additional domain controllers and restarted Netlogon service, then Netlogon folder appeared in all the windows 2016 domain controllers, but the SysVol folder is still missing, how can i replicate SysVol folder to windows 2016 domain controllers ?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters -> set the SysvolReady flag value to 0 and then to the Value 1

b.) Is it recommended to perform FRS to DFRS Migration, having the above mentioned issue alive with 2016 domain controllers ?

Answer 1

a. you can follow along here. https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/missing-sysvol-and-netlogon-shares
b. No you could not.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Hi @Anonymous ,

Thank you, does the article which you have shared is applicable for domain controller installed in windows server 2016 ?

Answer 3

No, windows server 2016 is perfectly fine to use older FRS technology. The prerequisite before introducing the first 2016 domain controller: domain functional level needs to be 2003 or higher

The two prerequisites to introducing the first 2019 or 2022 domain controller are that domain functional level needs to be 2008 or higher and older sysvol FRS replication needs to have been migrated to DFSR
https://techcommunity.microsoft.com/t5/Storage-at-Microsoft/Streamlined-Migration-of-FRS-to-DFSR-SYSVOL/ba-p/425405

Any specific reason why sysvol folder is not replicated to windows server 2016 domain controllers ?

We can only guess but the usual suspects are that domain health may have not been 100% before new ones were added. You can follow along here as a first step towards resolution. https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/missing-sysvol-and-netlogon-shares

General steps are as follows; I'd use dcdiag / repadmin tools to verify health correcting all errors found before starting any operations. Then stand up the new 2016, patch it fully, license it, join existing domain, add active directory domain services, promote it also making it a GC (recommended), transfer FSMO roles over (optional), transfer pdc emulator role (optional), use dcdiag / repadmin tools to again verify health, when all is good you can decommission / demote old one.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 4

Hi @Nithyanandham Singaravadivelu ,

If you have removed all your DC on 2008 in this condition, I guess you should be in an inconsistent state right?
I suggest you restore at least one of you DC on 2008, and go through the streamlined upgrading process below for migrating fsr to DFSR, and carefully confirm that new DFSR folder are created and replicating, since it doesn’t use the same as FSR, that is supposed to be deleted when you reach the migration state 3.
So it is highly important that you confirm everything is replicating correctly before moving to state 3 final migration.
It’s careful to consider staying at state 2 for some days even weeks to confirm news 2016 DC are working well before finalizing, the reason is that you still have a restore point in case of issue what you don’t have once you move to the state 3

https://techcommunity.microsoft.com/t5/storage-at-microsoft/streamlined-migration-of-frs-to-dfsr-sysvol/ba-p/425405

Hope this will be helpful...