Avatar of Joby Jacob
Joby Jacob
 asked on

Server Migration with Missing Sysvol

So here's the scene. I was brought in in the middle of a server migration because the other sys admin left. DC1 is a Server 2008 box being migrated to DC2 which is a Server 2012R2 VM. The server roles (AD DS, DNS, File and Storage Services) were already installed on DC2 and the domain level FSMO roles was already migrated to DC2. As I came in, I installed Windows Server Backup on both machine and took a backup of each that were saved to a NAS. I proceed to migrate the remaining 2 FSMO roles, and swap IPs so anything mapped by IP instead of DNS doesn't break. I was going to remove DC1 as a global catalog, remove the roles, and decommission it, but I wanted to hold off for a little bit. Everything was working fine until I powered down DC1 and rebooted DC2. DC2 could not open Active Directory. Rebooted DC2, same thing. Rebooted DC2 and powered DC1 back on. Everything working again. i checked DC2 and I see no SYSVOL folder. Come to find out both servers are running NTFRS instead of DFS-R. I thought maybe migrating from FRS to DFS-R would help, so I perform the migration. What's interesting is as I go from state 0 to 1, 1 to 2, and 2 to 3 on DC1, the same thing happens automatically on DC2 as I'm checking both servers to see what state they are in. Finished DFS-R migration, but still no SYSVOL folder on DC2. What's worse is now there's no SYSVOL folder on DC1 either. There is a SYSVOL_DFSR but it seems empty. I did make a copy of the SYSVOL folder before the migration, so I have that. When I go to Event Viewer on DC2, I go to Custom Views>Server Roles>Active Directory Domain Services and I get a pop-up error saying File Replication Service Access is denied. Help! I'm afraid to turn the old server off. I was going to try a non-authoritative restore, but I'm not sure if I can do that since the SYSVOL folder on DC1 is now gone.
Windows Server 2012* Distributed File System Replication (DFSR)* fsmo

Avatar of undefined
Last Comment
Peter Hutchison

8/22/2022 - Mon
Peter Hutchison

I would revert to doing a  restore, but just a  file system restore of the C:\Windows\SYSVOL folder.
You can boot the DC into DSRM mode to do a restore, it doesn't matter what state its in.
ASKER CERTIFIED SOLUTION
DrDave242

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
Joby Jacob

ASKER
Both DC1 and DC2 have a SYSVOL share that was mapped to C:\Windows\SYSVOL_DFSR\sysvol. They both were indeed empty. I got the copy of the SYSVOL folder from earlier and copied the entire contents (staging, staging areas, sysvol, and domain folders) to the SYSVOL_DFSR folder. Waited less than 5 minutes and the folders had replicated. Shutdown DC1 and rebooted DC2. DC2 is now able to access Active Directory without problems. Events viewer still gives me a pop up that says File Replication Service  Access is denied, but I'm thrilled DC2 is able to function without DC1. Thank you very much!
Joby Jacob

ASKER
Thank God for backups. Copying the contents from the SYSVOL backup to the SYSVOL_DFSR folder pushed replication and resolved the AD issue!
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes
DrDave242

Excellent! I wouldn't worry about that FRS error in the event log. FRS isn't being used for anything now, so that error doesn't really mean anything.
Peter Hutchison

Open GPMC console and check for any Policy errors. IF the Default Domain Policy or Default Domain Controller Poluicy is missing you can restore the default using the DcGpoFix.exe command.

http://www.grouppolicy.biz/2011/12/how-to-reset-the-default-domain-group-policy-objects-dcgpofix/