How to stop DFSR replication preventing a Domain Controller from advertising Domain Services

active-directorywindows-server-2012

I had set up a 'test' domain with two Windows 2012 AD domain controllers (DC1 & DC2), both virtual machines.

Unfortunately, DC1 (the FSMO holder) became completely corrupted.

While I could start again, it is proving very instructive to attempt to repair DC2.

Steps taken so far:

  1. Used ntdsutil to seize the FSMO roles
  2. Used ntdsutil to remove the failed controller from the domain.

However, I am still unable to connect to the domain using AD "Sites and Services", which states that the domain could not be contacted.

Investigating further, I'm seeing a DFSR error (unsurprisingly) trying to replicate from DC1, and the domain won't go active until it is complete (which can never happen, obviously).

The actual error is:

The DFS Replication service initialized SYSVOL at local path C:\Windows\SYSVOL\domain and is waiting to perform initial replication. The replicated folder will remain in the initial synchronization state until it has replicated with its partner DC1. If the server was in the process of being promoted to a domain controller, the domain controller will not advertise and function as a domain controller until this issue is resolved. This can occur if the specified partner is also in the initial synchronization state, or if sharing violations are encountered on this server or the sync partner. If this event occurred during the migration of SYSVOL from File Replication service (FRS) to DFS Replication, changes will not replicate out until this issue is resolved. This can cause the SYSVOL folder on this server to become out of sync with other domain controllers.

Additional Information:

(Detailed info relating to the Domain replication group, GUIDs etc).

My question, then, is how do I force DFSR to abort this "initial synchronization", in order to proceed further?

Best Answer

As mentioned in KB216498, ntdsutil does not automatically remove DFS-R objects upon metadata cleanup.

You might be able to workaround the SYSVOL initial replication issue by simply connecting to the default NC on DC02 and removing the DFS-R object for DC01, as explained in Step 21 in the Procedure:

  1. Logon a domain controller as a domain administrator in the affected domain.
  2. Start Adsiedit.msc.
  3. Connect to the default naming context.
  4. Locate the following DFS Replication topology container: CN=Topology,CN=Domain System Volume,CN=DFSR-Globalsettings,CN=System,DC=Your Domain,DC=Domain Suffix
  5. Delete the msDFSR-Member CN object that has the old computer name.
Related Topic