[ACTIVE DIRECTORY] – SYSVOL and NETLOGON not syncing

SYSVOL and NETLOGON folders weren’t syncing between domain controllers or the folders did not exist at the secondary DC.

If you have this issue, users that authenticate at the DC that don´t have the data of SYSVOL and NETLOGON will not receive the GPO policy and will receive errors when you run the GPUPDATE command.

To fix the sync between DC follow the instructions below:

1. Logon to your primary Domain Controller and Stop the DFS Replication service.
   START->ADMINISTRATIVE TOOLS -> SERVICES
   
2. Open ADSI EDIT and connect to the Default Naming Context
   
   
3. Expand ADSIEDT until the CN=SYSVOL Subscription of the Primary Domain Controller
   CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PRIMARY-DOMAIN-CONTROLLER,OU=Domain Controllers,DC=DOMAIN.LOCAL
   
4. Edit the attribute of the two entries:
   1. msDFSR-Enabled=FALSE
      
      
   2. msDFSR-options=1 
      
5. Now access the secondary DC (or others that you may have) and change from ADSIEDIT (steps 2-4):
   CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=SECONDARY-DOMAIN-CONTROLLER,OU=Domain Controllers,DC=DOMAIN.LOCAL
   1. msDFSR-Enabled=False
      
6. Back to the Primary Domain Controller, open PowerShell as admin, and force the replication with the command bellow

   repadmin /syncall PRIMARY-DC-NAME /APed

   Be sure the command terminates with no errors
   

7. Start DFS Replication service back on Primary Domain Controller
   
8. Now open Eventvwr and check the DFS Replication event with ID 4114
   
9. From Primary Domain Controller, open again ADSIT and change the msDFSR-Enabled to TRUE
   CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PRIMARY-DOMAIN-CONTROLLER,OU=Domain Controllers,DC=DOMAIN.LOCAL
   
   
10. Open Command one more time and run

    DFSRDIAG POLLAD

    

11. REPEAT STEP 6
    Back to the Primary Domain Controller, open PowerShell as admin, and force the replication with the command bellow

    repadmin /syncall PRIMARY-DC-NAME /APed

12. Open Eventvwr and check the DFS Replication event with ID 4602 (it could take some time to show up)
    
13. Now access the secondary DC (or others that you may have) and change from ADSIEDIT (steps 2-4):
    CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=SECONDARY-DOMAIN-CONTROLLER,OU=Domain Controllers,DC=DOMAIN.LOCAL
    1. msDFSR-Enabled=True
        
14. Open Command one more time and run

    DFSRDIAG POLLAD

    

15. Wait a few minutes and access each DC:
    1. Access the \\localhost
       1. You should see NETLOGON and SYSVOL folder
    2. Access Eventvwr you should see event ID 4114