Documente Academic
Documente Profesional
Documente Cultură
fr/2013/08/windows-server-2012-
issues-with-active_16.html
[
Windows Server 2012] Issues with Active Directory in
a Lab environment - Part 3
Active Directory is a great feature in Windows Server. However, imagine that you stop your lab
environment for several days, weeks and perhaps months. You will certainly encounter some
troubles when you'll try to turn on again your DCs.
In that series, I will share my own experience and show how to solve that troubles.
3. This server has been disconnected from other partners for 60 days
Symptoms
You note that replication of the SYSVOL folder between your DCs doesn't work: For example, if
you add manually a file in that folder, that file is not replicated on the other DC. That problem can
also create some troubles on computers if they can't download the right version of their GPO.
Of course, all DCs are online and can be joined normally.
In Event logs,you find the Event ID 4012 with the following description:
The DFS Replication service stopped replication on the folder with the following local path:
C:\Windows\SYSVOL\domain. This server has been disconnected from other partners for 60
days, which is longer than the time allowed by the MaxOfflineTimeInDays parameter (60).
DFS Replication considers the data in this folder to be stale, and this server will not replicate the
folder until this error is corrected.
Error: 9061 (The replicated folder has been offline for too long.)
Replicated Folder Name: SYSVOL Share
In the rest of the description you get the following resolution proposal:
To resume replication of this folder, use the DFS Management snap-in to remove this server from
the replication group, and then add it back to the group. This causes the server to perform an
initial synchronization task, which replaces the stale data with fresh data from other members of
the replication group.
However, even if you add the DFS Management snap-in on your DCs (not installed by default),
you can't accomplish the actions. Indeed, the SYSVOL replication group settings are protected
and provided in read-only mode.
- For the domain controller you want to make authoritative (preferably the PDC Emulator, which
is usually the most up to date for SYSVOL contents) ONLY, modify also the following attribute:
msDFSR-options=1
- Force Active Directory replication throughout the domain and validate its success on all DCs
(open ADSIEDIT and check attributes values)
- On the DC you set as authoritative, type the command line DFSRDIAG POLLAD
Note: Microsoft indicates that on Windows Server 2008 R2 you will see Event ID 4602 in the
DFSR event log indicating SYSVOL has been initialized. On a Windows Server 2012, I never saw
Event ID 4602 but Event ID 46014:
The DFS Replication service initialized SYSVOL at local path C:\Windows\SYSVOL\domain and
is waiting to perform initial replication...
Perform the previous commands on all the other DCs:
- Restart the DFSR service. You will see Event ID 4114 in the DFSR event log.
- Open the CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-
LocalSettings,CN=<the server name>,OU=Domain Controllers,DC=<domain> object
- Modify the following attribute:
msDFSR-Enabled=TRUE
- Type the command line DFSRDIAG POLLAD
To monitor the replication queue, you can use the following command line:
Dfsrdiag backlog /sendingMember:DC2012 /RGName:"Domain System Volume"
/RFName:"SYSVOL Share"
To ensure SYSVOL replication works correctly, just create a file in the SYSVOL folder and ensure
that file is replicated on all the other DCs.