SYSVOL not shared, or Group Policy files missing on one controller

One controller is affected and at least one is healthy.

1. Confirm the state.

   PowerShellCopy

   dcdiag /test:sysvolcheck /test:netlogons /v | Select-String 'passed|failed'net shareGet-WinEvent -LogName 'DFS Replication' -MaxEvents 40 | Format-Table TimeCreated,Id,Message -Wrap

2. Check the replication state of the SYSVOL group.

   PowerShellCopy

   Get-CimInstance -Namespace root\microsoftdfs -ClassName DfsrReplicatedFolderInfo | Format-Table ReplicatedFolderName,State

   State 4 is normal. State 5 means it is in an error state, and state 2 means initial synchronisation. Anything other than 4 explains the missing share without further investigation.

3. Set this controller to non-authoritative, so it pulls a fresh copy from a healthy partner.

   PowerShellCopy

   $dn = (Get-ADDomainController -Identity $env:COMPUTERNAME).ComputerObjectDNSet-ADObject -Identity "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,$dn" -Replace @{ 'msDFSR-Enabled' = $false }repadmin /syncall /AdePRestart-Service DFSR

4. Wait for event 4114, then re-enable.

   PowerShellCopy

   Get-WinEvent -LogName 'DFS Replication' -MaxEvents 10 | Where-Object Id -eq 4114 | Format-List TimeCreated,Message

5. Re-enable replication and let it pull.

   PowerShellCopy

   $dn = (Get-ADDomainController -Identity $env:COMPUTERNAME).ComputerObjectDNSet-ADObject -Identity "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,$dn" -Replace @{ 'msDFSR-Enabled' = $true }repadmin /syncall /AdePRestart-Service DFSR

6. Wait for event 4614 followed by 4604, which is the confirmation that SYSVOL is now shared.

net share | findstr /i "sysvol netlogon"dcdiag /test:sysvolcheck /test:netlogons | Select-String 'passed|failed'

Every controller is affected. One copy has to be nominated as correct.

1. Back up the SYSVOL contents from the controller with the most complete copy, before anything else.

   PowerShellCopy

   Copy-Item C:\Windows\SYSVOL\domain -Destination D:\sysvol-backup -Recurse -Force

   An authoritative restore discards every other copy. If the one you nominate turns out to be missing policies, this backup is the only route back.

2. Check every controller's copy before choosing which is authoritative.

   PowerShellCopy

   Get-ADDomainController -Filter * | ForEach-Object {  $n = $_.HostName  [PSCustomObject]@{ DC = $n; Policies = (Get-ChildItem "\\$n\SYSVOL\$env:USERDNSDOMAIN\Policies" -ErrorAction SilentlyContinue).Count }}

3. Stop the DFSR service on every controller.

   PowerShellCopy

   Get-ADDomainController -Filter * | ForEach-Object { Invoke-Command -ComputerName $_.HostName { Stop-Service DFSR -Force } }

4. On the chosen controller, set msDFSR-options to 1 and Enabled to false, then start DFSR, wait for event 4114, set Enabled true and restart.

   PowerShellCopy

   $dn = (Get-ADDomainController -Identity $env:COMPUTERNAME).ComputerObjectDNSet-ADObject -Identity "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,$dn" -Replace @{ 'msDFSR-Enabled'=$false; 'msDFSR-options'=1 }

5. Set every other controller non-authoritative and start them, one at a time, confirming each completes before the next.

6. Wait for event 4602 on the authoritative controller, which confirms the initial sync completed.

Get-ADDomainController -Filter * | ForEach-Object { "$($_.Name): " + (Get-ChildItem "\\$($_.HostName)\SYSVOL\$env:USERDNSDOMAIN\Policies").Count }