Server Migration with Missing Sysvol

Joby Jacob
Joby Jacob used Ask the Experts™
on
So here's the scene. I was brought in in the middle of a server migration because the other sys admin left. DC1 is a Server 2008 box being migrated to DC2 which is a Server 2012R2 VM. The server roles (AD DS, DNS, File and Storage Services) were already installed on DC2 and the domain level FSMO roles was already migrated to DC2. As I came in, I installed Windows Server Backup on both machine and took a backup of each that were saved to a NAS. I proceed to migrate the remaining 2 FSMO roles, and swap IPs so anything mapped by IP instead of DNS doesn't break. I was going to remove DC1 as a global catalog, remove the roles, and decommission it, but I wanted to hold off for a little bit. Everything was working fine until I powered down DC1 and rebooted DC2. DC2 could not open Active Directory. Rebooted DC2, same thing. Rebooted DC2 and powered DC1 back on. Everything working again. i checked DC2 and I see no SYSVOL folder. Come to find out both servers are running NTFRS instead of DFS-R. I thought maybe migrating from FRS to DFS-R would help, so I perform the migration. What's interesting is as I go from state 0 to 1, 1 to 2, and 2 to 3 on DC1, the same thing happens automatically on DC2 as I'm checking both servers to see what state they are in. Finished DFS-R migration, but still no SYSVOL folder on DC2. What's worse is now there's no SYSVOL folder on DC1 either. There is a SYSVOL_DFSR but it seems empty. I did make a copy of the SYSVOL folder before the migration, so I have that. When I go to Event Viewer on DC2, I go to Custom Views>Server Roles>Active Directory Domain Services and I get a pop-up error saying File Replication Service Access is denied. Help! I'm afraid to turn the old server off. I was going to try a non-authoritative restore, but I'm not sure if I can do that since the SYSVOL folder on DC1 is now gone.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Peter HutchisonSenior Network Systems Specialist

Commented:
I would revert to doing a  restore, but just a  file system restore of the C:\Windows\SYSVOL folder.
You can boot the DC into DSRM mode to do a restore, it doesn't matter what state its in.
Principal Support Engineer
Commented:
Run net share on both DCs. Is there a SYSVOL share on either one? If so, it will likely map to the SYSVOL_DFSR folder. If it does, that's normal after the migration; the actual folder path doesn't matter.

Assuming you have a SYSVOL share on both DCs, use File Explorer to browse through the share's local path on each one to see what's contained there. If it really is empty, try simply copying the contents of SYSVOL (from that copy you made beforehand) into the new folder. Give it a few minutes, then check to see if it replicated to the other DC. Please post your results here.
Joby JacobSysAdmin

Author

Commented:
Both DC1 and DC2 have a SYSVOL share that was mapped to C:\Windows\SYSVOL_DFSR\sysvol. They both were indeed empty. I got the copy of the SYSVOL folder from earlier and copied the entire contents (staging, staging areas, sysvol, and domain folders) to the SYSVOL_DFSR folder. Waited less than 5 minutes and the folders had replicated. Shutdown DC1 and rebooted DC2. DC2 is now able to access Active Directory without problems. Events viewer still gives me a pop up that says File Replication Service  Access is denied, but I'm thrilled DC2 is able to function without DC1. Thank you very much!
Build an E-Commerce Site with Angular 5

Learn how to build an E-Commerce site with Angular 5, a JavaScript framework used by developers to build web, desktop, and mobile applications.

Joby JacobSysAdmin

Author

Commented:
Thank God for backups. Copying the contents from the SYSVOL backup to the SYSVOL_DFSR folder pushed replication and resolved the AD issue!
DrDave242Principal Support Engineer

Commented:
Excellent! I wouldn't worry about that FRS error in the event log. FRS isn't being used for anything now, so that error doesn't really mean anything.
Peter HutchisonSenior Network Systems Specialist

Commented:
Open GPMC console and check for any Policy errors. IF the Default Domain Policy or Default Domain Controller Poluicy is missing you can restore the default using the DcGpoFix.exe command.

http://www.grouppolicy.biz/2011/12/how-to-reset-the-default-domain-group-policy-objects-dcgpofix/

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial