Authoritative & Non-Authoritative SYSVOL Synchronization (DFSR)

1. Scope, Failure Symptoms & Architecture Overview

The SYSVOL share hosts all Group Policy Objects (GPOs) and startup/logon scripts across all Domain Controllers. In modern Active Directory domains (functional levels 2008 through 2025), SYSVOL is replicated exclusively via Distributed File System Replication (DFSR).

Common Failure Symptoms

• SYSVOL / NETLOGON Shares Missing: Get-SmbShare shows neither share published on one or more DCs.
• Event ID 2213 (Dirty Shutdown): DFSR halted after abrupt host power loss or hypervisor crash.
• Event ID 4012 (Max Offline Time Exceeded): Replication stopped because a DC was offline longer than MaxOfflineTimeInDays (default: 60 days).
• GPO Mismatches: Group policies edited on DC-01 never arrive on DC-02 or branch DCs.

---

2. Recovery Matrix: Determining the Remediation Path

Operational Scenario	Target Remediation	Impact
Single DC Out of Sync / Shares Missing	Non-Authoritative Restore	Low. The affected DC purges local cache and pulls fresh SYSVOL from a healthy partner DC.
All DCs Corrupted / Entire Domain Deadlocked	Authoritative Restore	High / Controlled. Designates one DC as the authoritative master; forces all others to rebuild from it.
Event ID 2213 (Dirty Shutdown)	Resume Command via WMI	Zero. Re-enables replication without rebuilding database.

---

3. Fast-Path: Responding to Event ID 2213 (Dirty Shutdown)

If the DFSR event log displays Event ID 2213, replication was simply suspended for integrity verification:

# 1. Retrieve the Volume GUID from Event ID 2213
$Event = Get-WinEvent -LogName "DFS Replication" -MaxEvents 5 | Where-Object { $_.Id -eq 2213 } | Select-Object -First 1

# 2. Resume DFSR using WMI method
$VolumeGUID = (wmic /namespace:\\root\microsoftdfs path dfsrvolumeinfo get volumeguid | Select-String -Pattern "(\{.*\})").Matches.Value
wmic /namespace:\\root\microsoftdfs path dfsrmachineinfo call ResumeReplication $VolumeGUID

# 3. Verify Event ID 2214 (Replication successfully resumed)
Get-WinEvent -LogName "DFS Replication" -MaxEvents 5 | Where-Object { $_.Id -in 2214, 4604 }

---

4. Procedure A: Non-Authoritative SYSVOL Restore (Single DC)

Execute this procedure on an out-of-sync DC (DC-02) when a healthy partner DC (DC-01) exists.

Step 1: Pre-Flight Safety Backup

On DC-02, backup the existing local SYSVOL folder:

Copy-Item -Path "C:\Windows\SYSVOL" -Destination "C:\Windows\SYSVOL_PreRestore_Backup" -Recurse -Force

Step 2: Disable DFSR Subscription in Active Directory

Run on DC-02 (or from any management station):

# Stop DFSR service on the troubled DC
Stop-Service -Name DFSR -Force

# Locate the DFSR Local Subscription object in AD
$DCDistinguishedName = (Get-ADDomainController -Identity "DC-02").DistinguishedName
$SubscriptionPath = "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,$DCDistinguishedName"

# Set msDFSR-Enabled = FALSE
Set-ADObject -Identity $SubscriptionPath -Replace @{"msDFSR-Enabled"=$false}

Step 3: Force AD Replication & Start DFSR

# Force immediate AD replication to DC-02
repadmin /syncall /AdeP

# Start DFSR service
Start-Service -Name DFSR

# Wait for Event ID 4114 in "DFS Replication" log (Confirms disabled state recognized)
Get-WinEvent -LogName "DFS Replication" -MaxEvents 5 | Where-Object { $_.Id -eq 4114 }

Step 4: Re-Enable DFSR Subscription

# Set msDFSR-Enabled = TRUE
Set-ADObject -Identity $SubscriptionPath -Replace @{"msDFSR-Enabled"=$true}

# Force AD replication again
repadmin /syncall /AdeP

# Poll DFSR until Event ID 4614 or 4604 occurs (Initial sync complete, shares restored)
Get-WinEvent -LogName "DFS Replication" -MaxEvents 10 | Where-Object { $_.Id -in 4604, 4614 }

---

5. Procedure B: Authoritative SYSVOL Restore (Domain-Wide Outage)

Authoritative Restore Authority

This procedure establishes ONE Domain Controller (DC-01) as the single source of truth for SYSVOL. It must only be invoked when SYSVOL replication has collapsed domain-wide.

Step 1: Identify Master DC & Stop Services Across ALL DCs

Select the DC with the most current, verified GPO files (DC-01).

# Stop DFSR on ALL Domain Controllers in the domain
Invoke-Command -ComputerName "DC-01", "DC-02" -ScriptBlock {
    Stop-Service -Name DFSR -Force
}

Step 2: Mark Partner DCs as Non-Authoritative

Run on the master DC (DC-01):

# Set partner DC-02 msDFSR-Enabled = FALSE
$DC02_DN = (Get-ADDomainController -Identity "DC-02").DistinguishedName
Set-ADObject -Identity "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,$DC02_DN" -Replace @{"msDFSR-Enabled"=$false}

Step 3: Mark Master DC as Authoritative

On DC-01:

$DC01_DN = (Get-ADDomainController -Identity "DC-01").DistinguishedName
$DC01_Subscription = "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,$DC01_DN"
$DC01_SysvolVolume = "CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,$((Get-ADDomain).DistinguishedName)"

# 1. Ensure master is enabled
Set-ADObject -Identity $DC01_Subscription -Replace @{"msDFSR-Enabled"=$true}

# 2. Mark master as Authoritative (msDFSR-Options = 1)
Set-ADObject -Identity $DC01_SysvolVolume -Replace @{"msDFSR-Options"=1}

# Force AD replication
repadmin /syncall /AdeP

Step 4: Restart Master DC DFSR & Verify Event ID 4602

# Start DFSR on DC-01 only
Start-Service -Name DFSR

# Wait for Event ID 4602 (Confirms DC-01 is initialized as authoritative source)
Get-WinEvent -LogName "DFS Replication" -MaxEvents 5 | Where-Object { $_.Id -eq 4602 }

Step 5: Re-Enable Partner DCs Sequentially

Once DC-01 logs Event ID 4602:

# Re-enable DC-02 subscription
Set-ADObject -Identity "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,$DC02_DN" -Replace @{"msDFSR-Enabled"=$true}

# Force AD replication
repadmin /syncall /AdeP

# Start DFSR on DC-02
Invoke-Command -ComputerName "DC-02" -ScriptBlock { Start-Service -Name DFSR }

---

6. Operational Verification Checks

Execute across all Domain Controllers:

• SYSVOL and NETLOGON Share Publishing:

  Invoke-Command -ComputerName "DC-01", "DC-02" -ScriptBlock { Get-SmbShare -Name SYSVOL, NETLOGON }

• DFSR Backlog Check (Must be 0):

  # Check if any GPOs are stuck in outbound queue from DC-01 to DC-02
  Get-DfsrBacklog -SourceComputerName "DC-01" -DestinationComputerName "DC-02" -GroupName "Domain System Volume" -FolderLogicalName "SYSVOL Share"

• Directory Diagnostics:

  dcdiag /test:FrsSysvol /v

---

7. Rollback Procedure

If the authoritative restore causes unexpected loss of newer policy files:

1. Stop the DFSR service immediately across all DCs: Stop-Service DFSR -Force
2. Restore the pre-restore backup directory C:\Windows\SYSVOL_PreRestore_Backup back to C:\Windows\SYSVOL\sysvol.
3. Check GPO consistency with Get-GPO -All to ensure registry GUIDs match directory records.