Deleted Domain System Volume. How do I recreate it; I have no backups

Question

As the title suggest I am basically screwed. Before all this happen; I had one problem: My group policies were not replicating from PDC to other DCs. I have three Dc's in production.

As you can see Policy number (78B9346A) which was created on Dec 22nd in PDC did not replicate to the two other DC's. I also created a test file on the Sysvol folder for DC1 and it didn't replicate to the other DC's. You can see that in the image below:

Prior to the replication issue all my Dc’s were running Windows Server 2008 R2. Now they are running Windows Server 2012. They have been upgraded and everything worked fine except the replications. I installed the DFS role on my PDC. When I looked at the replication group setup for Domain System Volume, it included one of the Decommissioned Dc’s as a member. I figured that is causing the replication problem. I tried to edit the replication group but I couldn’t, so I deleted and tried to recreate it. That is when all the issue popped up. When I recreated the group:

I started getting the event ID 6410 and 6002.

Event 6410 says: The DFS Replication service failed to initialize replicated folder C:\Windows\SYSVOL\domain because the service detected that one of its working folders overlaps a Windows system folder. This is an unsupported configuration.

Event 6002 says: The DFS Replication service detected invalid msDFSR-Subscriber object data while polling for configuration information. I went back to DFS management and run a diagnostic report and I got the error below:

Now, I am clueless on what to do next and how to get the replication up and running. Some of the computers in my environment receives the policies, and some don’t. I really appreciate any help that will help me fix this issue. I have no backup, so I can perform an authoritative restore. Thanks in advance for any replies and I am sorry if I posted this in the wrong place.

Answer 1

You have to use Ldifde to recreate CN=Domain System Volume. Export CN=Domain System Volume from another domain controller, then modify the export file to match the name of the DC that's missing Domain System Volume and reimport it.

Look in ADSIEdit to see what I'm talking about:

Export:

LDIFDE –f output.txt –d "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=AnotherDC,OU=Domain Controllers,DC=dom,DC=com" –p base

Then change the exported file - update the dn: (Distinguished Name) and the msDFSR-MemberReference so that the dn: corresponds to the domain controller that is missing its CN=Domain System Volume, and the msDFSR-MemberReference refers to CN=AnotherDC,DC=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=domain,DC=com

Then import it back in with Ldifde -i -f import.txt

Hope that helps. Ldifde is the only way to recreate the Domain System Volume subscription. If none of your DCs have Domain System Volume objects... then, you are pretty well screwed. This is why we take backups of things. (And don't use the DFSR Management GUI to mess with Sysvol.)

Answer 2

I ran into a similar situation and found this guide to be helpful. https://community.spiceworks.com/how_to/160786-how-to-re-build-sysvol-dfsr-replication-group-without-demoting-promoting-dc. It leverages processes used in the dcpromo operation to recreate the DFS replication group for the SYSVOL dirs.

1. Take a backup!
2. Stop the DFSR service on all DCs Make sure that all the existing DFS groups targeting the SYSVOL share are deleted on all DCs in DFS Management
3. Open ADSI Edit
4. If you don't see your domain listed in the left pane go to Action > Connect to.... You should see a window with some default connection info. For me the default information was correct so I clicked OK
5. Expand the tree for your domain and look for OU=Domain Controllers
6. Expand each Domain Controller and locate CN=DFSR-LocalSettings
7. Assuming you do not have any other DFS groups associated with these DCs delete everything in the CN=DFSR-LocalSettings folder
8. Go back to your domain in the left pane and locate CN=Systems > CN=DFSR-GlobalSettings and delete any subfolder that isn't an active DFS group. Please verify before deleting!
9. Force replication to all DCs. Run repadmin /syncall /AdeP on ALL DCs. Verify from AFSI Edit on the other DCs that the changes are visible.
10. Add the following registry entries on your primary DC substituting your AD domain name for <your ad domain>.

# Create the key below
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DFSR\Parameters\SysVols\Promoting SysVols
# Add the following DWORD32 entry
Sysvol Information is Committed=1

# Create the key below
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DFSR\Parameters\SysVols\Promoting SysVols\<your ad domian>
# Create the following DWORD32 entry
Is Primary=1
# Create the following string entries
Command=DcPromo
Parent Computer= 
Replicated Folder Name=<your ad domain>
Replicated Folder Root=C:\Windows\SYSVOL\Domain
Replicated Folder Root Set=C:\Windows\SYSVOL\sysvol\<your ad domain>
Replicated Folder Stage=C:\Windows\SYSVOL\staging areas\<your ad domain>
Replication Group Name=<your ad domain>
Replication Group Type=Domain

11. Start the DFSR service on the primary DC and wait a minute or two for things to start up.
12. If it worked the registry entries you created should be gone. Instead you should see the following key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DFSR\Parameters\SysVols\Seeding Sysvols
13. Check the DC in AFSI Edit for a CN=Domain System Volume entry under DFSR-LocalSettings. You should also see the primary DC under CN=System > CN=DFSR-GlobalSettings > CN=Domain System Volume > CN=Topology > CN=<your primary dc>
14. Force sync on all DCs again repadmin /syncall /AdeP
15. One by one go through each DC and add the following registry entries

# Create the key below
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DFSR\Parameters\SysVols\Promoting SysVols
# Add the following DWORD32 entry
Sysvol Information is Committed=1

# Create the key below
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DFSR\Parameters\SysVols\Promoting SysVols\<your ad domian>
# Create the following DWORD32 entry
Is Primary=0
# Create the following string entries
Command=DcPromo
Parent Computer=<your primary dc>
Replicated Folder Name=<your ad domain>
Replicated Folder Root=C:\Windows\SYSVOL\Domain
Replicated Folder Root Set=C:\Windows\SYSVOL\sysvol\<your ad domain>
Replicated Folder Stage=C:\Windows\SYSVOL\staging areas\<your ad domain>
Replication Group Name=<your ad domain>
Replication Group Type=Domain

16. Start the DFSR service
17. Force replication again repadmin /syncall /AdeP
18. Check for the DC in AFSI Edit on the primary DC for a CN=Domain System Volume entry under DFSR-LocalSettings. You should also see the DC under CN=System > CN=DFSR-GlobalSettings > CN=Domain System Volume > CN=Topology > CN=<your dc>
19. Check DFS Managment to see if it is working. A healthy DFS Managment view will look like this

Once you repeat steps 15-18 on each DC your environment should be working. You may have to wait several minutes for everything to sync.

Thanks to ZooM_00 on Spiceworks for pointing me in the right direction!