Domain DFS Namespace Target Folder Client Cache Not Refreshed

George Perkins 10 Reputation points
2023-03-23T21:22:07.0233333+00:00

I have searched the Internet for answers to this intermittent problem without success. Hoping somehow posting here will get the attention of someone at Microsoft with deep DFS-N knowledge.

I have observed intermittent "Access Denied" errors when a client attempts to connect to a recently changed DFS-N target folder path. The DFS-N target "\\serv1.domain.com\share" is disabled and a new target is created/enabled "\\serv2.domain.com\share"). The target Referral cache duration is set to the default 1800 seconds. Time has passed after the target is updated for all Domain Controllers to replicate and client's cache to update (more than an hour).

The solution so far is

  1. restart the client
  2. on a client with RSAT DFS Management Tools installed, in an elevated command window:

DFSUTIL /PKTFLUSH

DFS-N.jpg

In the screenshot attached, you can see the failure when DIR command for a FQDN path is used, then success when DIR command is used with a NetBIOS shortname path. This is an illustration only, the FQDN or shortname will both fail, one or the other will fail; it is an intermittent problem which seems resolved by a restart or DFSUTIL /PKTFLUSH, but is really only fixed until a new Target is modified in the DFS Namespace.

If the DFS-N client is a user PC, the restart is not too disruptive, only a single user is impacted. If there are many users experiencing the problem, then the Service Desk gets many calls and many users are impacted by a restart. Since RSAT is not typically installed on PCs, there is no good work-around to a restart.

If the DFS-N client is a server, then a restart is very difficult to schedule. RSAT can be installed, but this requires notification of server owner, possible change management approvals.

And then if we just ignore the root-cause, always restarting or PKTFLUSH, then in the future whenever we update DFS-N target paths we have this issue again and again. I am looking for a permanent solution to the root-cause and understand why the DFS-N client cache is not always updated every 30 minutes.

Note: I am not using DFS-R (replication).

I am an experienced senior enterprise systems administrator. I have used Distributed File System Namespace (DFS-N) Target Folders many years on Windows Server 2003, 2008, 2012 with Windows 7 clients. I am at a new employer for several years and now we have a requirement to use DFS-N. All of the systems are Windows Server 2016, 2019 and Windows 10 22H2. <Begin Rant> So I do appreciate in advance do not patronize me with "restart" "run chkdsk" "run sfc /scannow" "run antivirus" or other noob answers. <End Rant>

Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
3,458 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,127 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,858 questions
Windows 10 Network
Windows 10 Network
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Network: A group of devices that communicate either wirelessly or via a physical connection.
2,272 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Limitless Technology 43,941 Reputation points
    2023-03-24T12:26:20.4033333+00:00

    Hello there,

    You can try the below steps and see if they helps:

    -Ensure the server’s network interface card drivers are updated.

    -Ensure that your antivirus software is aware of the replication and any necessary exclusions are set. You can also try disabling your antivirus software to see if that’s the issue.

    -Use the DFS command line in the following command lines to troubleshoot further:

    Get-DfsrBacklog: This command shows pending updates between two Windows-based file servers that participate in DFSRfile replication service.

    Get-DfsrState: This command shows you the current replication state of DFSR in regard to its DFS replication group partners.

    There is no other way to clear the DFS cache without DFSUTIL.exe.

    Or another possible way to clear the cache is to simply reboot the client. https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dfsutil

    Hope this resolves your Query !!

    --If the reply is helpful, please Upvote and Accept it as an answer–