Very Large Sysvol folder on 2008DC's

Hi there, we have a customer who has 18 sites each site with its own DC.  Majority are 2008R2 but there are a couple of 2012R2

They don't have any particularly large/major GPOs or software deployment policy's in place.
Their Sysvol\Domain is 30GB which seems rather large to me.  When I do a treesize it shows just under 91000 folders each showing 0.0MB
We have copied to Sysvol in a policy definitions folder the ADM/ADMXX templates from MS for Windows 7/8/Server 2008/2012 which accounts for 8MB and 381files with 9 subfolders.

Checking for any replication issues using the Ad replication status tool and DC diag isn't reporting any majors or tomb stoned servers

They are using Branch DFS to replicate the Branch data to the main branch server but not the other way around.
This all goes to a central folder on the Main server which is on a different partition to the Sysvol drive at around 45GB total.

Would appreciate knowing if this is normal or abnormal and any advice on how to shrink it if it is abnormal.

Ive attached a dir of the sysvol.
SoftlinksolutionsTechnical Services EngineerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Look for hidden folders DfsrPrivate
This likely includes a deleted/conflict related files.  The folder size of DFSRPrivate  is limited to each server

Presumably you are using dfsr or there will be an ntfrs related notice.

No large distribution, there should not be large files in the sysvol stracture.
SoftlinksolutionsTechnical Services EngineerAuthor Commented:
Hi there thanks for your response, but the DFSRPrivate folders are all on the D drive as that's where the DFS replication goes.  
There is no DFSRPrivate folders on the C drive where the reported large 30GB Sysvol is unfortunately.

Where you mention NTFRS there are many many folders in sysvol with NTFRS in the name though.
NTFRS means that your sysvol replication is using the old NTFRS, usually DFS replicated folders contain within them the DFSRPrivate folder.

NTFRS should have a prestaging/existing see if those folders account for the large space consumption.

Did you start from 2008 or you had AD before?

Ref the document at Guide to NTFRS to DFS migration of sysvol.

The above is a document that needs downloading, the following is a web version.
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

SoftlinksolutionsTechnical Services EngineerAuthor Commented:
Hi thanks for the links Arnold ill take a look through those and try and check the prestaging.

To my knowledge they started out as SBS2008 then went to full blown Server 2008 at a single site. Then over the course of time they have had added one at a time a site server which are also 2008 up until recently this year when they have only just had their first 2 2012 servers.

Do you think this Sysvol size sounds large for 18 DCs each at their own location?
YES, sysvol only has GPO/GPP settings. unless you have software deployments whose content is actually/usually  stored in a different\separate share, each GPO is about 4 -6 MB
Depending on what you have in sysvol, unless you use netlogon for software deployment where you place 100's of MB MSI, EXEs.
Those could collide and be saved.
The staging files over many many years could go large.
i.e. DC1 to DC2 is having NTFRS replication issues.
DC1 sysvol keeps getting more and more files added, DC1 maintains the files it received not from DC2 in a list destined to DC2.
FRS has problems transferring large files.  Usually you had to make registry changed if files were large.
A dc with 18 Dcs could have 17 sets of staging files for each DC with which it replicates.

look at c:\windows\sysvol on a DC
sysvol within is the sysvol share with the GPO and domain\scripts as netlogon
is this folder 30GB?
The other folders are domain hard link to sysvol/ADdomain
staging and staginf_areas is one of these have the bulk of the

dcdiag /v
does it report issues with one or some of the Dcs??

Is the sysvol large on one, a few or on all Dcs?

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
SoftlinksolutionsTechnical Services EngineerAuthor Commented:
Hi there yes its the c:\windows\sysvol\domainname\sysvol that's 30GB

Looking a bit closer on main DC we have
ClientAgent folder 778KB consisting of 7 Files and 2 Folders
Within this there is a
ClientAgent.vbs VB script
This is the script
Path = UCase(Trim(WScript.Arguments(0)))
set argv = WScript.Arguments

if( Right(Path,4) = ".EXE" ) then
    Set WshShell = WScript.CreateObject("WScript.Shell")
    args = ""
    For i = 0 to argv.Count - 1
        args = args & Trim(argv(i)) & " "
    Next args,0,True
    DstPath = UCase(Trim(WScript.Arguments(1)))
    set fso = CreateObject("Scripting.FileSystemObject")
    fso.CopyFile Path, DstPath, FALSE
end if

Then a Machine  folder consisting of

Then a User Folder consisting of

We then have a further 53,712 folders that are ClientAgent_NTFRS_########_NTFRS_######
(some folder names repeat for longer upto 7x NTFRS_########)
Totalling 25GB
Each folder on average is around 778KB

Then we have
Policies Folder 9MB Consisting of 22 folders one of which is policy definitions containing all the adm admx templates which is 8MB.
The other folders are {########-####-####-####-##########} with each of the GPOs

Below that we have a further 30, 023 Policies_NTFRS_########_NTFRS####### folders Totalling 5GB
(some folder names repeat for longer upto 7x NTFRS_########)
Each consisting of what looks to be the same but only around 14 {########-####-####-####-##########} GPO folders.  There is not the Policy Definitions folder.
Each folder looks to be the same size of around 146KB although some look to be empty.

Then we have the Scripts folder which has 1 subfolder and 17 files
Each file is a logon.bat file relevant to each site which is just to map drives. This is only 100KB

Below that we have a further 7,064 Folders called scripts_NTFRS_########_NTFRS_#######
(some folder names repeat for longer upto 7x NTFRS_########)
totalling 170MB
Each one looks to contain the same as above scripts folder although some are empty. They are all around the same size of 40KB

Checking the other DC's they are looking to contain the same.

The only issue is a conflict between 2 sites

A warning event occurred.  EventID: 0x800034FA

            Time Generated: 09/10/2015   16:55:29

            Event String:

Following is the summary of warnings and errors encountered by File Replication Service while polling the Domain Controller for FRS replica set configuration information.

  The nTDSConnection object cn=server\0acnf:9079b218-b4e4-4e46-a929-99626877f0f9,cn=ntds settings,cn=otherserver,cn=servers,cn=othersite,cn=sites,cn=configuration,dc=bew,dc=dc,dc=local
is conflicting with
cn=server,cn=ntds settings,cn=othersite,cn=servers,cn=othersite,cn=sites,cn=configuration,dc=dc=. Using cn=server\0acnf:9079b218-b4e4-4e46-a929-99626877f0f9,cn=ntds settings,cn=otherserver,cn=servers,cn=othersite,cn=sites,cn=configuration,dc=dc,dc=local

With regards to the other DC's checking their sysvols they seem to vary greatly
One has 109,000 folders
another 51,000 folders
another 49,000 folders
another 27,367 folders

Is there anything that can be done to clean this up?

I believe that the SBS client agent isn't needed any more as they aren't using SBS.
Can the empty folders be deleted?

Im not overly keen going to DFS replication as I would rather sort this out first otherwise I think I will just be replicating the problem in a different way.

I cannot see the NTFRS prestaging/existing folders you mention.

Did you see the attached DIR output of the SYSVOL directory?
As that shows the length some of the folders names get to.

The exe/msi are only part.

You need to look at the event log on the one where there is the 24gb likely mean it has issues trying to replicate something.

The staging files keep growing if there is replication issues ........pick one, and using baretail capture a set of the data, it will indicate what it is trying to replicate.

Usually, one would have stored the exe msi files in sysvol, pre dfs, with dfs domain based share, one would locate the exe/msi files there instead of within sysvol.

It is possible that the exe/msi could not replicate among the DCs, do each time a new one was added, someone copied those manually .....

Guessing. There should be event log entries for frs issue related to replication that would explain ......
The ntfrs_########### I think is the instance for each new replicant was added ( additional DC added to the environment)
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.