Configuring DFS Replication of SYSVOL

SYSVOL, a folder located at %SystemRoot%\SYSVOL by default, contains logon scripts, group policy templates (GPTs), and other resources critical to the health and management of an Active Directory domain. Ideally, SYSVOL should be consistent on each domain controller. However, changes to Group Policy objects and to logon scripts are made from time to time, so you must ensure that those changes are replicated effectively and efficiently to all domain controllers.

Use the buttons below to navigate through the lesson


In previous versions of Windows, the FRS was used to replicate the contents of SYSVOL between domain controllers. FRS has limitations in both capacity and performance that cause it to break occasionally. Unfortunately, troubleshooting and configuring FRS is quite difficult. In Windows Server 2008 domains, you have the option to use DFS-R to replicate the contents of SYSVOL. In this lesson, you will learn how to migrate SYSVOL from FRS to DFS-R.

Note in order to utilize this function, the domain must be running at Windows Server 2008 domain functional level. Domain and Forest functional levels will be discussed later in the course.

Because SYSVOL is critical to the health and functionality of your domain, Windows does not provide a mechanism with which to convert replication of SYSVOL from FRS to DFS-R instantly.

In fact, migration to DFS-R involves creating a parallel SYSVOL structure. When the parallel structure is successfully in place, clients are redirected to the new structure as the domain’s system volume. When the operation has proven successful, you can eliminate FRS.

Migration to DFS-R thus consists of four stages or states:

  • 0 (start) The default state of a domain controller. Only FRS is used to replicate SYSVOL.
  • 1 (prepared) A copy of SYSVOL is created in a folder called SYSVOL_DFSR and is added to a replication set. DFS-R begins to replicate the contents of the SYSVOL_DFSR folders on all domain controllers. However, FRS continues to replicate the original SYSVOL folders and clients continue to use SYSVOL.
  • 2 (redirected) The SYSVOL share, which originally refers to SYSVOL\sysvol, is changed to refer to SYSVOL_DFSR\sysvol. Clients now use the SYSVOL_DFSR folder to obtain logon scripts and Group Policy templates.
  • 3 (eliminated) Replication of the old SYSVOL folder by FRS is stopped. The original SYSVOL folder is not deleted, however, so if you want to remove it entirely, you must do so manually.

You move your domain controllers through these stages, using the Dfsrmig.exe command.

You will use three options with Dfsrmig.exe:

  • setglobalstate state The setglobalstate option configures the current global DFSR migration state, which applies to all domain controllers. The state is specified by the state parameter, which is 0–3. Each domain controller will be notified of the new DFSR migration state and will migrate to that state automatically.
  • getglobalstate The getglobalstate option reports the current global DFSR migration state.
  • getmigrationstate The getmigrationstate option reports the current migration state of each domain controller. Because it might take time for domain controllers to be notified of the new global DFSR migration state, and because it might take even more time for a
    DC to make the changes required by that state, DCs will not be synchronized with the global state instantly. The getmigrationstate option enables you to monitor the progress of DCs toward the current global DFSR migration state.

If there is a problem moving from one state to the next higher state, you can revert to previous states by using the setglobalstate option. However, after you have used the setglobalstate option to specify state 3 (eliminated), you cannot revert to earlier states.

In order to utilise DFSR the domain functional level must be set to 2008 mode. To check open Active Directory Domains and Trusts. Right click the domain and click Raise Domain Functional Level. The domain is at the correct level, if the domain is not at the correct level it can be raised here. Click Close to continue. Close Active Directory Domains and Trusts and then open the run box. Type CMD and click OK.

At the prompt type
dfsrmig /setglobalstate 1
Then press Enter.

1 (prepared) A copy of SYSVOL is created in a folder called SYSVOL_DFSR and is added to a replication set. DFS-R begins to replicate the contents of the SYSVOL_DFSR folders on all domain controllers. However, FRS continues to replicate the original SYSVOL folders and clients continue to use SYSVOL.

Stage one starts each stage of the process can take from 15 mins to 1 hour to complete. Each stage must complete in order to go to the next stage.

To check how the migration is proceeding at the prompt type
Dfsrmig /getmigrationstate
Then press enter.

Migration state is not consistent yet, keep issuing the previous command until all Dcs are consistent. When all DCs have reached a consistent state the next step can be started.

At the prompt type
dfsrmig /setglobalstate 2
Then press Enter.

2 (redirected) The SYSVOL share, which originally refers to SYSVOL\sysvol, is changed to refer to SYSVOL_DFSR\sysvol. Clients now use the SYSVOL_DFSR folder to obtain logon scripts and Group Policy templates.

Stage Two starts each stage of the process can take from 15 mins to 1 hour to complete. Each stage must complete in order to go to the next stage.

To check how the migration is proceeding at the prompt type
Dfsrmig /getmigrationstate
Then press enter.

When all DCs have reached a consistent state the next step can be started. When all DCs have reached a consistent state the next step can be started.

At the prompt type
dfsrmig /setglobalstate 3
Then press Enter.

3 (eliminated) Replication of the old SYSVOL folder by FRS is stopped. The original SYSVOL folder is not deleted, however, so if you want to remove it entirely, you must do so manually.

Stage Three starts each stage of the process can take from 15 mins to 1 hour to complete. Each stage must complete in order to go to the next stage.

When all DCs have reached a consistent state on stage three, the migration process is now complete. Close the command window. When all DCs have reached a consistent state on stage three, the migration process is now complete. Close the command window.

In the Windows folder the new SYSVOL_DFSR folder is displayed, the old sysvol folder is still in place but is now empty. In the Windows folder the new SYSVOL_DFSR folder is displayed, the old sysvol folder is still in place but is now empty. To test that the new folder is replicating correctly open the DFSR_SYSVOL folder. Open the Domain folder. Open the scripts folder. Right click and select New>Text Document. And name it Test Logon. Test Logon document has been created. Go to any other DC in your domain and check if this has replicated. Note replication can take sometime to complete.