Are users supposed to be able to access the root \\contoso.local location in Windows Explorer when using DFS?

Question

With DFS, are users supposed to be able to access the root \\contoso.local location in Windows explorer? (As opposed to only \\contoso.local\namespace?)

I ask because I'm working with a legacy system and I don't know what the people before me set up - perhaps they did something unrelated to DFS that makes \\contoso.local a browsable location. I'm also new to DFS.

DFS Info:

• Server: fileserver1.contoso.local
• Domain: contoso.local
• Namespace: dfs

I can access \\contoso.local\dfs and see all the dummy folders and targets correctly. However, I'm noticing that I can also access \\contoso.local\ in Windows Explorer, which displays the following volumes:

Share                    Location on Domain Controller
----------------------   ------------------------------------
NETLOGON                 C:\Windows\SYSVOL\sysvol\contoso.local\SCRIPTS
SYSVOL                   C:\Windows\SYSVOL\sysvol
UpdateServicesPackages   D:\WSUS\UpdateServicesPackages
WsusContent              D:\WSUS\WsusContent
WSUSTemp                 C:\Program Files\Updates Services\LogFiles\WSUSTemp

Note that we're not using Windows Server Update Services.

I sadly do no know if \\contoso.local\ was accessible prior to starting work on DFS.

So I guess my question is actually multiple parts:

1. Is it normal to be able to see items in \\contoso.local when using DFS?
2. Did the IT people before me hack things together on the DC for things like NETLOGON, SYSVOL, and WSUS, or are those shared folders pretty normal?

Answer 1

In the recommended (and default) configuration, the DNS entry for contoso.local will point to the domain controllers. So if you open \\contoso.local you will see the shares on one of the domain controllers, chosen at random.

NETLOGON and SYSVOL are always shared on DCs, they're part of the mechanism that makes Active Directory work.

The other three shares are part of WSUS, so it would appear to be installed on whichever DC you are looking at, whether you're actually using it or not. Or perhaps it was installed previously but has since been uninstalled; I believe there's an option to uninstall it but leave the content in place. If in doubt, you could check whether the folder D:\WSUS actually exists.