FIX Group Policy Replication on SYSVOL & Non-Authoritative SYSVOL restore on DCS

FRS is a multi-threaded, multi-master replication engine that Windows Server domain controllers use to replicate system policies and logon scripts. You can also use FRS to replicate content between Windows Servers that host the same fault-tolerant Distributed File System (DFS) roots or child node replicas. In Windows Server 2008 R2 and newer, FRS can only be used to replicate the Domain SYSVOL replica set.

 

If you ever come across this problem you may alike have a replication or tainted  sysvol

2018-12-09 12_43_38-gpo sysvol not accessible - Google Search.png

Also, you will alike find on \\localhost (DCS) \Sysvol that they have different files or GPOS;

This means somehow a GPO or ANTIVIRUS tainted the sysvol replication and it is not working anymore;

 

Prior doing changes make sure:

1.Backup all the DCS

2.Backup GPOS

3.Backup Sysvol Folder from each Domain controller

THE FIX

1. We will head to the secondary DCS and stop the File system replication service on all of them

2. Modify burnflags registry  on the dcs ( remember file system replication service must be stopped! )

https://support.microsoft.com/en-gb/help/290762/using-the-burflags-registry-key-to-reinitialize-file-replication-servi

Modify the following Registry setting on each secondary DC

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup

Change burnflags to D2 ( Hexadecimal value )

3. Start the file system replication on the DCS and wait for sync; Process can be monitored on the event viewer

4. Once done this you will have rebuilt all of the sysvol folders on the secondary domain controllers pulling the config from the main DC if you still have issues you can try the Authoritative restore ( burnflags value changes to D4 and must be done on the main domain controller )

5. Check all your GPOS and if you find yourself with the error “data not accessible ” just restore the GPO from the backup, eventually, if you follow this process you will fix the GPO replication

 

 

 

 

 

 

 

 

 

 

 

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s