SYSVOL seems to be messed after promoting a new DC

Question

SYSVOL seems to be messed after promoting a new DC

Anonymous

I promoted a new DC, but after that I am not totally sure if SYSVOL is working properly. I looked for the warnings/errors but they have different possible solutions and I do not know what to do. Below are the warnings/error I have found:

There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL
replication problems may cause Group Policy problems.
......................... VSRVMDC01 failed test DFSREvent
An error event occurred. EventID: 0xC0001B81

20220521 20:54:37.742 9744 INCO 7114 InConnection::RestartSession Retrying establish contentset session. connId:{C328CDFF-0A65-4180-8250-7B6A27750081} csId:{C5CAE082-A025-459D-A976-21D1C8B97A86} csName:SYSVOL Share
20220521 20:54:37.742 9744 INCO 1021 [WARN] SessionTask::Step (Ignored) Failed, should have already been processed. Error:

[Error:9027(0x2343) InConnection::TransportEstablishSession inconnection.cpp:7701 9744 C A failure was reported by the remote partner]
[Error:9027(0x2343) DownstreamTransport::EstablishSession downstreamtransport.cpp:4076 9744 C A failure was reported by the remote partner]
[Error:9027(0x2343) DownstreamTransport::EstablishSession downstreamtransport.cpp:4055 9744 C A failure was reported by the remote partner]
[Error:9051(0x235b) DownstreamTransport::EstablishSession downstreamtransport.cpp:4055 9744 C The content set is not ready]

DFS Report:

The last DFS replication logs on event viewer show IDs like 6806, 1210, 1206, 6102, 5004, so I do not know if I can just ignore messages.

Hope you can help me.

10 answers

Your answer

Answer 1

Anonymous

In case I decide to try the non-authoritative sync, this value: msDFSR-Enabled has to be modified just in the DC with problems (DC03), right?.

and on the other two DCs (DC01 and DC02), I will not modify anything, right?

besides this option, what other options do I have just to make sure that SYSVOL is working fine?

Thanks for your help.

Answer 2

Anonymous

Correct
Check the event log details for clues as I mentioned above.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Anonymous

2022-05-22T22:12:52.3+00:00

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 3

Anonymous

I applied the non-authoritative sync, but event id 4604 is not showing yet, is this is normal?

Anonymous

2022-05-23T01:35:45.01+00:00

What error's (if any) are in the DFS Replication and System event logs since the restore? (event source and event IDs)

Answer 4

Anonymous

There are no errors, just the warning with id 4614.

Answer 5

Anonymous

Ok, well there shouldn't be all these unexplained problems. Domain controller promotion should work without a hitch assuming there weren't problems beforehand. If it were my I'd decommission / demote the new one, do cleanup if needed.
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-metadata-cleanup
https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-manually-removing-a-domain-controller-server/ba-p/280564

then check domain health is 100% (dcdiag, repadmin tools) before trying again.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Anonymous

2022-05-26T14:25:22.303+00:00

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--
Anonymous

2022-05-27T03:33:47.39+00:00

Hi DSPatrick,

Today we promoted a new virtual machine as a DC (previous DC was denoted), but the warning is still showing up (eventid 4614).

I found these new information:

1) the state of sysvol share is 2:

According to this command, some file are pending to replicate:

the structure of DFSRPrivate folder in every DC is different:

Do you think that this folder needs to be restored?
Anonymous

2022-05-27T12:43:34.097+00:00

Sounds like the new domain controller is not the problem but the sysvol structure is somehow damaged? If so this one may be helpful.
https://gist.github.com/RavuAlHemio/00e51d3ea64731be9d43b01eda18734f

--please don't forget to upvote and Accept as answer if the reply is helpful--
Anonymous

2022-05-27T17:47:16.517+00:00
I have some questions about this article, hope you can help me:

does msDFSR-Option on authoritative DC never goes back to 0?

With this article, I only replace files and folders from this path: %WinDir%\SYSVOL\domain, but what about folders like dfsrPrive?

In my environment DC01 will be de authoritative DC, DC03 will be the non-authoritative DC and what about DC02? Non-authoritative too?
Anonymous

2022-05-27T23:52:00.12+00:00

I did not write the document. You can try asking the author, if they're still active.

Also these ones may help about the staging folders.
https://techcommunity.microsoft.com/t5/storage-at-microsoft/staging-changes-in-windows-server-2008/ba-p/423544
https://techcommunity.microsoft.com/t5/storage-at-microsoft/staging-folder-guidelines-for-dfs-replication/ba-p/423200
https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/manually-clearing-the-conflictanddeleted-folder-in-dfsr/ba-p/395711

--please don't forget to upvote and Accept as answer if the reply is helpful--
Anonymous

2022-05-30T12:22:49.063+00:00

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--

Share via

SYSVOL seems to be messed after promoting a new DC

10 answers

Your answer