Skip to content

Force authoritative synchronization for DFSR-replicated SysVol Replication using PowerShell

Notifications You must be signed in to change notification settings

21bshwjt/SysVol-D4-PowerShell

Folders and files

NameName
Last commit message
Last commit date

Latest commit

ย 

History

96 Commits
ย 
ย 
ย 
ย 
ย 
ย 
ย 
ย 

Repository files navigation

Force DFSR Sysvol Replication using PowerShell


๐Ÿ‘‰ D4/D2 Manual Process Has Been Mentioned Here -> Microsoft KB


Use-Cases

- 1. Missing SysVol/Netlogon folders on Domain Controller/s.
- 2. GPO Inconsistencies across the Domain Controller/s.

Instructions & prerequisites

  • ๐Ÿ‘‰ ๐˜Š๐˜ญ๐˜ฐ๐˜ฏ๐˜ฆ ๐˜ต๐˜ฉ๐˜ฆ ๐˜™๐˜ฆ๐˜ฑ๐˜ฐ : ๐˜จ๐˜ช๐˜ต ๐˜ค๐˜ญ๐˜ฐ๐˜ฏ๐˜ฆ ๐˜ฉ๐˜ต๐˜ต๐˜ฑ๐˜ด:https://๐˜จ๐˜ช๐˜ต๐˜ฉ๐˜ถ๐˜ฃ.๐˜ค๐˜ฐ๐˜ฎ/21๐˜ฃ๐˜ด๐˜ฉ๐˜ธ๐˜ซ๐˜ต/๐˜š๐˜บ๐˜ด๐˜๐˜ฐ๐˜ญ-๐˜‹4-๐˜—๐˜ฐ๐˜ธ๐˜ฆ๐˜ณ๐˜š๐˜ฉ๐˜ฆ๐˜ญ๐˜ญ.๐˜จ๐˜ช๐˜ต
  • ๐Ÿ‘‰ ๐˜Š๐˜ฐ๐˜ฑ๐˜บ ๐˜š๐˜ค๐˜ณ๐˜ช๐˜ฑ๐˜ต๐˜ด ๐˜ง๐˜ฐ๐˜ญ๐˜ฅ๐˜ฆ๐˜ณ ๐˜ช๐˜ฏ๐˜ต๐˜ฐ ๐˜ต๐˜ฉ๐˜ฆ ๐˜—๐˜‹๐˜Š
  • ๐Ÿ‘‰ ๐˜‹๐˜ฐ๐˜ฎ๐˜ข๐˜ช๐˜ฏ ๐˜ˆ๐˜ฅ๐˜ฎ๐˜ช๐˜ฏ๐˜ด ๐˜—๐˜ณ๐˜ช๐˜ท๐˜ช๐˜ญ๐˜ฆ๐˜จ๐˜ฆ๐˜ด
  • ๐Ÿ‘‰ ๐˜™๐˜ฆ๐˜ฒ๐˜ถ๐˜ช๐˜ณ๐˜ฆ๐˜ด ๐˜ˆ๐˜ค๐˜ต๐˜ช๐˜ท๐˜ฆ ๐˜‹๐˜ช๐˜ณ๐˜ฆ๐˜ค๐˜ต๐˜ฐ๐˜ณ๐˜บ ๐˜”๐˜ฐ๐˜ฅ๐˜ถ๐˜ญ๐˜ฆ
  • ๐Ÿ‘‰ ๐˜™๐˜ถ๐˜ฏ ๐˜ต๐˜ฉ๐˜ฐ๐˜ด๐˜ฆ ๐˜š๐˜ค๐˜ณ๐˜ช๐˜ฑ๐˜ต๐˜ด ๐˜ช๐˜ฏ ๐˜ด๐˜ฆ๐˜ฒ๐˜ถ๐˜ฆ๐˜ฏ๐˜ค๐˜ฆ
  • ๐Ÿ‘‰ ๐˜š๐˜ค๐˜ณ๐˜ช๐˜ฑ๐˜ต ๐˜ฏ๐˜ถ๐˜ฎ๐˜ฃ๐˜ฆ๐˜ณ๐˜ช๐˜ฏ๐˜จ ๐˜ฉ๐˜ข๐˜ท๐˜ฆ ๐˜ฃ๐˜ฆ๐˜ฆ๐˜ฏ ๐˜ฅ๐˜ฐ๐˜ฏ๐˜ฆ ๐˜ฃ๐˜ข๐˜ด๐˜ฆ๐˜ฅ ๐˜ฐ๐˜ฏ ๐˜ณ๐˜ฆ๐˜ข๐˜ฅ๐˜ฎ๐˜ฆ ๐˜ง๐˜ช๐˜ญ๐˜ฆ ๐˜ฏ๐˜ถ๐˜ฎ๐˜ฃ๐˜ฆ๐˜ณ๐˜ช๐˜ฏ๐˜จ ๐˜ฉ๐˜ฆ๐˜ฏ๐˜ค๐˜ฆ 3, 8 & 12 ๐˜ข๐˜ณ๐˜ฆ ๐˜ฏ๐˜ฐ๐˜ต ๐˜ต๐˜ฉ๐˜ฆ๐˜ณ๐˜ฆ
  • ๐Ÿ‘‰ ๐˜š๐˜ค๐˜ณ๐˜ช๐˜ฑ๐˜ต๐˜ด 18 ๐˜ข๐˜ฏ๐˜ฅ 19 ๐˜ข๐˜ณ๐˜ฆ ๐˜ง๐˜ฐ๐˜ณ ๐˜ฑ๐˜ฐ๐˜ด๐˜ต-๐˜ท๐˜ข๐˜ญ๐˜ช๐˜ฅ๐˜ข๐˜ต๐˜ช๐˜ฐ๐˜ฏ๐˜ด
  • ๐Ÿ‘‰ ๐˜™๐˜ฆ๐˜ข๐˜ฅ ๐˜ต๐˜ฉ๐˜ฆ ๐˜ข๐˜ฃ๐˜ฐ๐˜ท๐˜ฆ ๐˜ฎ๐˜ฆ๐˜ฏ๐˜ต๐˜ช๐˜ฐ๐˜ฏ๐˜ฆ๐˜ฅ ๐˜”๐˜š๐˜๐˜› ๐˜’๐˜‰

๐ŸŒ€ 1. Set the DFS Replication service Startup Type to Manual and stop the service on all domain controllers in the domain.

$DCs = Get-ADGroupMember -Identity "Domain Controllers" | Select-Object -ExpandProperty Name 

# Change Service startup type to manual & stop the DFSR Service
$DCs | ForEach-Object -Process { 
    try {
        # Action that will run in parallel. Reference the current object via $PSItem and bring in outside variables with $USING:varname
        Invoke-Command -ComputerName $PSItem -ScriptBlock { 
            Set-Service -Name 'DFSR' -StartupType Manual -Verbose
            Stop-Service -Name 'DFS Replication' -Force -Verbose 
        } -ErrorAction Stop
    } catch {
        Write-Error "Failed to modify DFSR service on $PSItem Error: $_"
    }
}

๐ŸŒ€ 2. Verify DFSR Service Status from all Domain Controllers

# Get the DFSR Service Status
$DCs = Get-ADGroupMember -Identity "Domain Controllers" | Select-Object -ExpandProperty Name 
$GetoBj = Foreach ($DC in $DCs) { 
    Invoke-Command -ComputerName $DC { 
        [PSCustomObject]@{ 
            DomainController = ($env:COMPUTERNAME).ToUpper() 
            ServiceName      = (Get-Service -Name DFSR).Name 
            Status           = (Get-Service -Name DFSR).Status 
            StartType        = (Get-Service -Name DFSR).StartType 
        }  
    }  
}  
$GetoBj | Select-Object -Property DomainController, ServiceName, Status, StartType 

๐ŸŒ€ 3. In the ADSIEDIT.MSC tool, modify the following DN and two attributes on the domain controller you want to make authoritative (preferably the PDC Emulator, which is usually the most up-to-date for sysvol replication contents) - Manual

CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=<the server name>,OU=Domain Controllers,DC=<domain>

msDFSR-Enabled=FALSE
msDFSR-options=1

๐ŸŒ€ 4. Modify that using PowerShell - Automated

# Change PDC on ADSIEDIT 
# Get the PDC Emulator for the domain 
$PDCNameFull = (Get-ADDomain).PDCEmulator 
 
# Split the full server name to get only the server name part 
$PDCName = $PDCNameFull -split '\.' | Select-Object -First 1 
 
$domain = (Get-ADDomain).DistinguishedName 
 
# Construct the DN (Distinguished Name) 
$dn = "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=$PDCName,OU=Domain Controllers,$domain" 
 
# Set the attributes 
Set-ADObject -Identity $dn -Replace @{ 
    "msDFSR-Enabled" = $False 
    "msDFSR-options" = 1 
} -Verbose 

๐ŸŒ€ 5. Modify the following DN and single attribute on all other domain controllers in that domain

$domain = (Get-ADDomain).DistinguishedName 
 
$DCs = Get-ADGroupMember -Identity "Domain Controllers" | Select-Object -ExpandProperty Name  
 
foreach ($DC in $DCs) { 
 
    # Construct the DN (Distinguished Name) 
    $dn = "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=$DC,OU=Domain Controllers,$domain" 
 
    # Set the attributes 
    Set-ADObject -Identity $dn -Replace @{ 
        "msDFSR-Enabled" = $False 
    } -Verbose 
} 

๐ŸŒ€ 6. Force Active Directory replication throughout the domain and validate its success on all DCs.

repadmin /syncall /A /e /P /d /q

๐ŸŒ€ 7. Start the DFSR service on the PDC

# Get the PDC Emulator for the domain 
$PDCNameFull = (Get-ADDomain).PDCEmulator 
 
# Split the full server name to get only the server name part 
$PDCName = $PDCNameFull -split '\.' | Select-Object -First 1 
Invoke-Command -ComputerName $PDCName  {Start-Service -Name 'DFS Replication' -Verbose} 

๐ŸŒ€ 8. You'll see Event ID 4114 in the DFSR event log indicating sysvol replication is no longer being replicated.

๐ŸŒ€ 9. Set msDFSR-Enabled=TRUE on PDC

# Change PDC on ADSIEDIT 
# Get the PDC Emulator for the domain 
$PDCNameFull = (Get-ADDomain).PDCEmulator 
 
# Split the full server name to get only the server name part 
$PDCName = $PDCNameFull -split '\.' | Select-Object -First 1 
 
$domain = (Get-ADDomain).DistinguishedName 
 
# Construct the DN (Distinguished Name) 
$dn = "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=$PDCName,OU=Domain Controllers,$domain" 
 
# Set the attributes 
Set-ADObject -Identity $dn -Replace @{ 
    "msDFSR-Enabled" = $True 
} -Verbose 

๐ŸŒ€ 10. Force Active Directory replication throughout the domain and validate its success on all DCs.

repadmin /syncall /A /e /P /d /q

๐ŸŒ€ 11. Run the following command from an elevated command prompt on the same server that you set as authoritative:

DFSRDIAG POLLAD 

๐ŸŒ€ 12. You'll see Event ID 4602 in the DFSR event log indicating sysvol replication has been initialized. That domain controller has now done a D4 of sysvol replication.

๐ŸŒ€ 13. Start the DFSR service on the other non-authoritative DCs. You'll see Event ID 4114 in the DFSR event log indicating sysvol replication is no longer being replicated on each of them

$DCs = Get-ADGroupMember -Identity "Domain Controllers" | Select-Object -ExpandProperty Name 
# Start the DRSR Service  

$DCs | Foreach-Object -Process { 
    #Action that will run in Parallel. Reference the current object via $PSItem and bring in outside variables with $USING:varname 
    Invoke-Command -ComputerName $PSItem { Start-Service -Name 'DFS Replication' -Verbose 
    } 
} 

๐ŸŒ€ 14. Modify the following DN and single attribute on all other domain controllers in that domain:

$domain = (Get-ADDomain).DistinguishedName  
$DCs = Get-ADGroupMember -Identity "Domain Controllers" | Select-Object -ExpandProperty Name  
 
foreach ($DC in $DCs) {  
 
    $dn = "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=$DC,OU=Domain Controllers,$domain"  
    Set-ADObject -Identity $dn -Replace @{  
        "msDFSR-Enabled" = $True 
 
    } -Verbose  
}

๐ŸŒ€ 15. Run the following command from an elevated command prompt on all non-authoritative DCs (that is, all but the formerly authoritative one):

# Get members of the "Domain Controllers" group and store their names in $servers array
$servers = Get-ADGroupMember -Identity "Domain Controllers" | Select-Object -ExpandProperty Name

# Get the PDC Emulator for the domain 
$PDCNameFull = (Get-ADDomain).PDCEmulator 
 
# Split the full server name to get only the server name part 
$PDCName = $PDCNameFull -split '\.' | Select-Object -First 1 

# Remove PDC from the $servers array
$servers = $servers | Where-Object { $_ -ne "$PDCName" }

# Run DFSRDIAG POLLAD to all Non Auth DCs
$servers | ForEach-Object -Process {
    Invoke-Command -ComputerName $PSItem { DFSRDIAG POLLAD -Verbose }
}

๐ŸŒ€ 16. Return the DFSR service to its original Startup Type (Automatic) on all DCs.

$DCs = Get-ADGroupMember -Identity "Domain Controllers" | Select-Object -ExpandProperty Name 
# Change Service startup type Autometic

$DCs | Foreach-Object -Process { 
    Invoke-Command -ComputerName $PSItem { Set-Service -Name 'DFSR' -StartupType Automatic -Verbose
    } 
} 

๐ŸŒ€ 17. Verify DFSR Service Status from all Domain Controllers

# Get the DFSR Service Status
$DCs = Get-ADGroupMember -Identity "Domain Controllers" | Select-Object -ExpandProperty Name 

$GetoBj = foreach ($DC in $DCs) { 
    try {
        $result = Invoke-Command -ComputerName $DC -ScriptBlock {
            [PSCustomObject]@{ 
                DomainController = $env:COMPUTERNAME.ToUpper()
                ServiceName      = (Get-Service -Name DFSR -ErrorAction Stop).Name
                Status           = (Get-Service -Name DFSR -ErrorAction Stop).Status
                StartType        = (Get-Service -Name DFSR -ErrorAction Stop).StartType
            }
        }
    }
    catch {
        $result = [PSCustomObject]@{
            DomainController = $DC.ToUpper()
            ServiceName      = "DFSR"
            Status           = "Error: $($Error[0].Exception.Message)"
            StartType        = "Unknown"
        }
    }
    
    $result
}

$GetoBj | Select-Object -Property DomainController, ServiceName, Status, StartType

๐ŸŒ€ 18. SysVol Health Checkups for all the Domain Controllers across the domain

+ SysVol Health Checkups for all the Domain Controllers across the domain, Expected "State" values are '4' after sometime.
<#
State values are:
0: Uninitialized
1: Initialized
2: Initial Sync
3: Auto Recovery
4: Normal
5: In Error
Expected value is '4'.
#>
$servers = Get-ADGroupMember -Identity "Domain Controllers" | Select-Object -ExpandProperty Name 

foreach ($server in $servers) {
    try {
        $result = Get-WmiObject -Namespace "root\microsoftdfs" -Class "dfsrreplicatedfolderinfo" -ComputerName $server -Filter "replicatedfoldername='SYSVOL share'" | 
        Select-Object @{Name = 'DomainController'; Expression = { $_.MemberName } }, ReplicationGroupName, ReplicatedFolderName, State
        if ($result) {
            $result # | Format-Table -AutoSize
        }
        else {
            Write-Warning "No DFSR information found on $server for 'SYSVOL share'." 
        }
    }
    catch {
        Write-Warning "Error querying $server : $_"
    }
}

๐ŸŒ€ 19. Verify msDFSR-Enabled for msDFSR-options attribute values from all Domain Controllers (Optional)

+ msDFSR-options value will be "0" from "1" automatically into PDC after some time.
# msDFSR-options value will be "0" from "1" automatically into PDC after some time.
$domain = (Get-ADDomain).DistinguishedName 

$DCs = Get-ADGroupMember -Identity "Domain Controllers" | Select-Object -ExpandProperty Name 

$Objs = Foreach ($DC in $DCs){
    Get-ADObject -Filter {Name -eq "SYSVOL Subscription"} -SearchBase "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=$DC,OU=Domain Controllers,$domain" -Properties DistinguishedName, msDFSR-Enabled, msDFSR-options | 
    Select-Object DistinguishedName, msDFSR-Enabled, msDFSR-options
}

foreach ($Obj in $Objs){
    $msDFSR_options = $Obj.'msDFSR-options'
    if ([string]::IsNullOrWhiteSpace($msDFSR_options)) {
        $msDFSR_options = "<not set>"
    }

    [PSCustomObject]@{ 
        DomainController = ($($Obj.DistinguishedName) -split ",")[3].Substring(3)
        "msDFSR-Enabled" = $($Obj.'msDFSR-Enabled')
        "msDFSR-options" = $msDFSR_options
    } 
}

๐˜‰๐˜ช๐˜ด๐˜ธ๐˜ข๐˜ซ๐˜ช๐˜ต ๐˜‰๐˜ช๐˜ด๐˜ธ๐˜ข๐˜ด ๐˜ข.๐˜ฌ.๐˜ข ๐˜ฃ๐˜ด๐˜ฉ๐˜ธ๐˜ซ๐˜ต
๐˜Œ๐˜ฎ๐˜ข๐˜ช๐˜ญ: ๐˜ฃ๐˜ด๐˜ฉ๐˜ธ๐˜ซ๐˜ต@๐˜จ๐˜ฎ๐˜ข๐˜ช๐˜ญ.๐˜ค๐˜ฐ๐˜ฎ
๐˜“๐˜ช๐˜ฏ๐˜ฌ๐˜ฆ๐˜ฅ๐˜๐˜ฏ
๐Ÿ’ฆ ๐Ÿ’ฆ ๐Ÿ’ฆ


About

Force authoritative synchronization for DFSR-replicated SysVol Replication using PowerShell

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published