SYSVOL and NETLOGON Issues with Plan to Add 3 New Domain Controllers

Question

SYSVOL and NETLOGON Issues with Plan to Add 3 New Domain Controllers

Mohammad Adaileh 0

We currently have 3 Domain Controllers:

DC01 located in the Core Site (FSMO holder).

DC02 located in the Core Site.

DC03 located in the DMZ Site.

The issue is that DC02 does not receive or advertise SYSVOL and NETLOGON shares. The same problem exists on DC03. We have checked all configurations, but the issue persists.

Today, we promoted a new Windows Server 2025 as a Read-Only Domain Controller (RODC) in the DMZ. Replication and advertisement worked fine, but we faced the same issue as with DC02: SYSVOL and NETLOGON are not available.

We need guidance on:

Troubleshooting and resolving the SYSVOL/NETLOGON replication issue.

Ensuring proper replication for both Core and DMZ sites.

Best practices from Microsoft for adding 3 new Domain Controllers alongside the existing ones.We currently have 3 Domain Controllers:

DC01 located in the Core Site (FSMO holder).

  **DC02** located in the Core Site.
  
     **DC03** located in the DMZ Site.
     
     The issue is that **DC02** does not receive or advertise **SYSVOL** and **NETLOGON** shares. The same problem exists on **DC03**. We have checked all configurations, but the issue persists.
     
     Today, we promoted a new Windows Server 2025 as a **Read-Only Domain Controller (RODC)** in the DMZ. Replication and advertisement worked fine, but we faced the same issue as with DC02: **SYSVOL and NETLOGON are not available**.
     
     We need guidance on:
     
        Troubleshooting and resolving the SYSVOL/NETLOGON replication issue.
        
           Ensuring proper replication for both Core and DMZ sites.
           
              Best practices from Microsoft for adding 3 new Domain Controllers alongside the existing ones.

0 comments

2 answers

Your answer

Answer 1

The fact that AD replication works but SYSVOL/NETLOGON replication does not rather clearly points to a DFSR SYSVOL replication problem, not a general AD problem. Do not add the other three DCs yet. First confirm that DC01 is healthy by verifying that SYSVOL and NETLOGON are shared and running dcdiag /test:sysvolcheck /test:advertising, repadmin /replsummary, and repadmin /showrepl * /errorsonly.

On DC02 and DC03, check the DFS Replication event log and run dfsrdiag replicationstate. Look particularly for events such as 4612, 4602, 4604, 4012, and 4114, which indicate whether SYSVOL is waiting for initial synchronization or has a DFSR problem. Also verify that the DFSR SYSVOL subscription is in state 4 (Normal). If DC01 has a healthy SYSVOL, the normal repair approach is to make DC02 and DC03 non-authoritative for SYSVOL, allowing them to discard their local SYSVOL state and synchronize a fresh copy from DC01.

Do the same analysis for the new RODC. Since it successfully replicated AD but has no SYSVOL/NETLOGON, check whether DFSR is failing during its initial SYSVOL synchronization. For the DMZ, specifically verify AD Sites and Services, DNS, and firewall/RPC connectivity between the DMZ and Core, because DFSR depends on RPC and can fail even when ordinary AD replication works.

Once DC02, DC03, and the RODC all have working SYSVOL/NETLOGON and dcdiag and repadmin are clean, add the three new DCs one at a time, allowing replication to converge and checking SYSVOL/NETLOGON after each promotion. I would not demote/re-promote the existing DCs until the DFSR diagnosis shows that is necessary.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

For this scenario, focus first on why SYSVOL initial synchronization is not completing on DC02, DC03, and the new RODC. A domain controller will not fully advertise and function correctly until SYSVOL replication finishes.

Verify whether the environment is using DFSR or FRS for SYSVOL

If the affected DCs show DFSR events such as 4612, 4614, 5008, or RPC errors like 1722, the DC is waiting for initial SYSVOL replication.
In that state, the DC will not advertise and function as a domain controller until the issue is resolved.

Check the source partner used for initial SYSVOL sync

For DFSR-based SYSVOL, the promoted DC reads the Parent Computer value under: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DFSR\Parameters\SysVols\Seeding SysVols\domain.com
If that source DC is unavailable or unreachable after reboot, initial synchronization is delayed.
Resolve name resolution or network connectivity issues to that parent DC, or change Parent Computer to an available source DC.

Check replication connectivity between sites and partners

Missing SYSVOL and NETLOGON shares commonly occur on replica DCs when replication prerequisites are not met.
In Active Directory Sites and Services, verify that NTDS connection objects exist between the problem DCs and healthy DCs.
If connection objects are missing, use Check Replication Topology to let KCC build them.
If KCC cannot build them, create a manual connection object. Remove duplicate manual or automatic connections from the same source if they create a replication-blocking configuration.

Confirm Active Directory replication is healthy Run:

REPADMIN /SHOWREPS <upstreamDC>
REPADMIN /SHOWREPS <downstreamDC>

FRS replication depends on Active Directory replication.
The documented default replication intervals are five minutes for DCs in the same site and once every three hours for DCs in different sites, with a minimum of 15 minutes.

Check whether the source DC is itself healthy

The server used as the source for Active Directory and SYSVOL must already have created and shared NETLOGON and SYSVOL.
It should also have applied the default domain and domain controllers policy.
If the source DC has not completed this correctly, downstream DCs can remain stuck.

Review DFSR and Directory Service events on affected DCs Look for these documented indicators:

DFSR 4612: SYSVOL initialized and waiting for initial replication.
DFSR 4614: SYSVOL remains in initial synchronization state.
DFSR 5008 with 1722 RPC server unavailable: partner unreachable or DFS Replication service not running.
DFSR 1202: failed to contact a domain controller for configuration information; can be caused by TCP/IP, firewall, AD DS, or DNS issues.

If only NETLOGON is missing but SYSVOL exists This is a separate case from both shares being missing.

On Windows Server 2008-based DCs, Microsoft documents a workaround where SysvolReady is set to 0 and then back to 1 under: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Risk: this is a registry change. Back up the registry first.
This workaround does not apply when both SYSVOL and NETLOGON are missing.

For FRS-based troubleshooting, check whether files are actually moving

Check the destination folder and staging folder shown by NTFRSUTL DS.
A changing file count in staging or destination is a good sign that replication or file transition is occurring.

For Core and DMZ site replication, the most relevant Microsoft-backed checks are:

verify DNS and network connectivity to the selected parent/source DC
verify RPC communication if DFSR logs show 1722 or similar RPC failures
verify NTDS connection objects between sites
verify the source DC already has working SYSVOL and NETLOGON shares

For adding new domain controllers, the supported practice in the available guidance is to promote only against a healthy source DC that already shares SYSVOL and NETLOGON, and to confirm initial SYSVOL replication completes before treating the new DC as fully functional. If the new RODC advertises but SYSVOL and NETLOGON are still absent, treat that as incomplete SYSVOL initialization and fix replication to its parent/source DC first.

References: