Scenario:
You have promoted a new domain controller into an existing Active Directory environment. The new DC however does not have the NETLOGON or SYSVOL shares locally.
You see event log errors in the DFS Replication logs such as 4612, 6016, etc.
You’ve rebooted each DC and waited more time with no changes to the issue.
Solutions:
You may need to perform what known as a D2 and/or D4 FRS Authoritive Restore.
Note: D2 and D4 are technically FRS terms but have made their way into DFSR although completely unrelated.
In most cases, you’ll need to skip right past the non-authoritve restore and go straight to an authoritive restore, but in some cases, a non-authoritive restore can work, so we’ll document that process here…
Non-Authoritive Restore:
In the ADSIEDIT.MSC tool, modify the following distinguished name (DN) value and attribute on each of the domain controllers (DCs) that you want to make non-authoritative:
CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=<the server name>,OU=Domain Controllers,DC=<domain>
msDFSR-Enabled=FALSE
Force AD replication throughout the domain – run the below command on each DC:
repadmin /syncall
Poll AD changes in DFSR:
DFSRDIAG POLLAD
You’ll see Event ID 4114 in the DFSR event log indicating sysvol replication is no longer being replicated.
On the same DN from Step 1, set msDFSR-Enabled=TRUE
Force AD replication throughout the domain – run the below command on each DC:
repadmin /syncall
Poll AD changes in DFSR:
DFSRDIAG POLLAD
You’ll see Event ID 4614 and 4604 in the DFSR event log indicating sysvol replication has been initialized. That domain controller has now done a D2 of sysvol replication.
Authoritive Restore:
Set the DFS Replication service Startup Type to Manual, and stop the service on all domain controllers in the domain.
In the ADSIEDIT.MSC tool, modify the following DN and two attributes on the domain controller you want to make authoritative (preferably the PDC Emulator, which is usually the most up-to-date for sysvol replication contents):
CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=<the server name>,OU=Domain Controllers,DC=<domain> msDFSR-Enabled=FALSE msDFSR-options=1
Modify the following DN and single attribute on all other domain controllers in that domain:
CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=<each other server name>,OU=Domain Controllers,DC=<domain> msDFSR-Enabled=FALSE
Force AD replication throughout the domain – run the below command on each DC:
repadmin /syncall
Start the DFSR service on the domain controller that was set as authoritative.
You’ll see Event ID 4114 in the DFSR event log indicating sysvol replication is no longer being replicated.
On the same DN on the same DC, set msDFSR-Enabled=TRUE.
Force AD replication throughout the domain – run the below command on each DC:
repadmin /syncall
Poll AD changes in DFSR:
DFSRDIAG POLLAD
You’ll see Event ID 4602 in the DFSR event log indicating sysvol replication has been initialized. That domain controller has now done a D4 of sysvol replication.
Start the DFSR service on the other non-authoritative DCs. You’ll see Event ID 4114 in the DFSR event log indicating sysvol replication is no longer being replicated on each of them.
Modify the following DN and single attribute on all other domain controllers in that domain:
CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=<each other server name>,OU=Domain Controllers,DC=<domain> msDFSR-Enabled=TRUE
Run the following command from an elevated command prompt on all non-authoritative DCs (that is, all but the formerly authoritative one):
DFSRDIAG POLLAD
Return the DFSR service to its original Startup Type (Automatic) on all DCs.
Wait about 15-30 mins.
Now check all DCs to ensure that both the NETLOGON and SYSvol shares are available for every DC, that all content is the same in each share on each DC and monitor event logs for errors.
More information and notes here: https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/force-authoritative-non-authoritative-synchronization