When Group Policy works for clients of one domain controller but not another, or a new DC never shares SYSVOL and NETLOGON, the DFS Replication log on the domain controllers usually says why. This reference lists the DFSR events Microsoft documents for SYSVOL, the legacy FRS events for domains that haven't migrated, and the FRS-to-DFSR migration errors, each with the usual cause, the first check and the safe fix.
Codes in this quick reference
DFSR 2212: unexpected shutdown detected on the volume; database recovery startedEvent Viewer (DFS Replication log)DFSR 2213: replication stopped on the volume after a dirty shutdown; resume it manuallyEvent Viewer (DFS Replication log)DFSR 2214: recovery from the dirty shutdown completedEvent Viewer (DFS Replication log)DFSR 4012: replication stopped; member failed to replicate longer than MaxOfflineTimeInDaysEvent Viewer (DFS Replication log)DFSR 4114: the SYSVOL replicated folder is disabled and no longer replicatedEvent Viewer (DFS Replication log)DFSR 4614: SYSVOL initialized and waiting to perform initial replicationEvent Viewer (DFS Replication log)DFSR 4604: SYSVOL initialized; initial synchronization completedEvent Viewer (DFS Replication log)DFSR 4602: SYSVOL initialized as the primary (authoritative) memberEvent Viewer (DFS Replication log)
+ 21 more codes in the tables below.
Watch out: don't start by deleting the DFSR database or forcing an authoritative sync. Microsoft discourages deleting the database, and an authoritative restore makes one DC's copy win everywhere. Repair the broken DC non-authoritatively unless every DC is in error.
How to read these events#
- DFS Replication log (Applications and Services Logs › DFS Replication, source DFSR) on each domain controller; detailed debug logs are in
%windir%\debug\dfsr*.log. - File Replication Service log (source NtFrs) only matters in domains that still replicate SYSVOL with FRS; its debug logs are
%SystemRoot%\Debug\NtFrs_001.logtoNtFrs_005.log. - Replicated folder state for
SYSVOL Share: 0 Uninitialized, 1 Initialized, 2 Initial Sync, 3 Auto Recovery, 4 Normal, 5 In Error. Every DC should report 4. - Shares: a DC shares SYSVOL and NETLOGON only after SYSVOL has initialized;
net shareon the DC shows them. Don't force sharing by editingSysvolReadyunderHKLM\System\CurrentControlSet\Services\Netlogon\Parameters.
Microsoft's checks across all DCs (run in an elevated command prompt), then the same from PowerShell on one DC:
For /f %i IN ('dsquery server -o rdn') do @echo %i && @wmic /node:"%i" /namespace:\\root\microsoftdfs path dfsrreplicatedfolderinfo WHERE replicatedfoldername='SYSVOL share' get replicationgroupname,replicatedfoldername,state
For /f %i IN ('dsquery server -o rdn') do @echo %i && @wmic /node:"%i" /namespace:\\root\microsoftdfs path DfsrMachineConfig get MaxOfflineTimeInDaysGet-CimInstance -Namespace root\microsoftdfs -ClassName DfsrReplicatedFolderInfo -Filter "ReplicatedFolderName='SYSVOL Share'" |
Select-Object ReplicationGroupName, ReplicatedFolderName, State
Get-CimInstance -Namespace root\microsoftdfs -ClassName DfsrMachineConfig | Select-Object MaxOfflineTimeInDays
Get-WinEvent -FilterHashtable @{LogName='DFS Replication'; Level=2,3} -MaxEvents 20 | Format-List TimeCreated, Id, MessageDFS Replication events for SYSVOL#
Dirty shutdowns and content freshness#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
2212 | DFSR detected an unexpected shutdown on the volume and started database recovery | Power loss, a service stopped before its database closed, disk problems | Wait for 2214; if it repeats, look for disk and ESENT errors |
2213 | Replication stopped on the volume after a dirty shutdown; DFSR waits for an administrator (the default since Windows Server 2012) | Same as 2212, with automatic recovery paused | Back up the replicated folders, then run the ResumeReplication command printed in the event |
2214 | Recovery from the dirty shutdown completed | Expected after 2212 or a resume | State returns to 4 |
4012 | Replication of the folder stopped because this member failed to replicate for longer than MaxOfflineTimeInDays (content freshness) | DC offline or broken for longer than the limit: 60 days when enabled (default from Windows Server 2012), 0 means off | Non-authoritative sync of that DC; authoritative only if every DC logged 4012 and reports state 5 |
The resume command from the 2213 event looks like this (use the volume GUID from your event); the PowerShell line is the CIM equivalent:
wmic /namespace:\\root\microsoftdfs path dfsrVolumeConfig where volumeGuid="<GUID from event 2213>" call ResumeReplicationGet-CimInstance -Namespace root\microsoftdfs -ClassName DfsrVolumeConfig -Filter "VolumeGuid='<GUID>'" | Invoke-CimMethod -MethodName ResumeReplicationMicrosoft also documents StopReplicationOnAutoRecovery (DWORD 0 under HKLM\System\CurrentControlSet\Services\DFSR\Parameters) to bring back automatic recovery; weigh it against the data-loss risk the pause protects you from. If 2212 follows ordinary restarts, DFSR may need longer to close its database at shutdown (WaitToKillServiceTimeout).
Initialization and the D2/D4 equivalents#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
4114 | The SYSVOL replicated folder is disabled and no longer replicated | Expected after msDFSR-Enabled=FALSE during a non-authoritative or authoritative sync | Continue: set it back to TRUE, replicate AD, dfsrdiag pollad |
4614 | SYSVOL is initialized and waiting to perform initial replication | New or non-authoritative DC waiting for a healthy partner | No 4604 after it? Check upstream partners for 2213 or 4012 |
4604 | SYSVOL initialized; initial synchronization completed | Good outcome | SYSVOL and NETLOGON shared |
4602 | SYSVOL initialized as the primary (authoritative) member | Authoritative sync, or a resume when no partner had initialized | Bring the other DCs back non-authoritatively |
6016 | The DFS Replication service failed to update configuration in Active Directory Domain Services (Error 5, Access is denied) | Permissions on the DC's DFSR-LocalSettings object | Default permissions on the DC computer object and Domain Controllers OU |
State 5 | The SYSVOL Share replicated folder is In Error | Usually one of the events above | The DFS Replication log on that DC |
A non-authoritative sync (the DFSR version of FRS "D2"): in ADSI Edit, open CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=<server>,OU=Domain Controllers,DC=<domain>, set msDFSR-Enabled=FALSE, force AD replication, run dfsrdiag pollad and wait for 4114; then set it to TRUE, replicate, poll again and wait for 4614 and 4604. The authoritative version (like "D4") also sets msDFSR-options=1 on the chosen DC, preferably the PDC emulator, with DFSR stopped on every DC; follow Microsoft's article step by step.
Partner communication#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
5002 | The DFS Replication service encountered an error communicating with the partner | Network, DNS or partner problems; the event names the partner, its IP and the error | The error string in the event |
5008 | Failed to communicate with the partner: host unreachable, or DFSR not running on it | Partner down, DFSR stopped, RPC blocked | Is the partner up and the DFSR service running? |
5012 | The partner did not recognize the connection or the replication group configuration | The partner hasn't received the current DFSR configuration from AD | AD replication between the two DCs; dfsrdiag pollad on both |
5014 | Communication with the partner stopped because of an error; DFSR retries and logs 5004 when the connection returns | Partner restart, network interruption, snapshot restore | Only a repeating 5014 without 5004 needs work: read its error code |
Legacy FRS events (File Replication Service log)#
FRS is deprecated and Windows Server 2019 and later can't be promoted into a domain that still uses it, so treat any FRS fix as a step toward migration.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
13508 | Trouble enabling replication from a partner using its DNS name; FRS keeps retrying | DNS can't resolve the partner, FRS isn't running there, or topology hasn't replicated to all DCs | nslookup the partner; net start ntfrs on it. 13509 follows when fixed |
13509 | Replication enabled after repeated retries | The 13508 condition cleared | None |
13511 | FRS is stopping because there is no free space on the volume | Disk full | Free space, then net start ntfrs |
13522 | FRS paused because the staging area is full | Outbound partners offline or closed schedules | Partners online; raise Staging Space Limit in KB |
13526 | Can't replicate with a partner because its SID can't be determined from its distinguished name | AD replication delay or stale objects | AD replication; FRS retries later |
13548 | The clock difference with the partner is outside the allowed range | Wrong time, or a wrong time zone (a gap near a multiple of 60 minutes) | Time and time zone on both DCs |
13552 | Unable to add this computer to the replica set | Invalid root path, missing directory or volume | Paths and error codes in the event |
13555 | FRS is in an error state | Several | Restart NtFrs; if it persists, follow the recovery in the event |
13557 | Duplicate connection object between this computer and a partner | Duplicate connections in Sites and Services | Delete all but one |
13559 | The replica root path has changed | SYSVOL moved | If intentional, create NTFRS_CMD_FILE_MOVE_ROOT under the new root |
13565 | Initializing the system volume with data from another DC; this computer can't become a DC until it finishes | New DC | net share until SYSVOL appears |
13568 | The replica set is in JRNL_WRAP_ERROR: the record FRS needs is gone from the USN journal | FRS stopped too long, heavy disk activity, a truncated or deleted journal | Non-authoritative restore with BurFlags D2 |
13575 | This DC uses DFS Replication for SYSVOL, so FRS was stopped | Expected after migration | Confirm DFSR state 4 |
For 13568, set BurFlags to D2 under HKLM\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup and restart NtFrs; 13516 confirms SYSVOL is ready to share.
FRS-to-DFSR migration errors#
- Promotion blocked:
The specified domain <domain> is still using the File Replication Service (FRS) to replicate the SYSVOL share. FRS is deprecated.The wizard tells you to migrate with DFSRMIG first. - Stuck between states:
dfsrmig /getmigrationstatereportsMigration has not yet reached a consistent state on all Domain Controllers.That's normal right after/setglobalstate. If DCs stay in Preparing after AD has converged anddfsrdiag polladhas run, look for 6016 or 8028 and Access is denied in the DFSR debug log. - In-place upgraded DCs: Windows Server 2019 DCs upgraded in place in an FRS domain can stick in the Start phase and stop sharing SYSVOL and NETLOGON; Microsoft has a dedicated workaround article.
The global states run 0 Start, 1 Prepared, 2 Redirected, 3 Eliminated. Move one state at a time and don't continue until every DC reports a consistent state.
How to verify a fix#
- The WMI query reports state 4 for
SYSVOL Shareon every DC, andnet sharelists SYSVOL and NETLOGON on each. - The events tell the story: 2212 then 2214 after a resume, 4614 then 4604 after a non-authoritative sync, 4602 on the authoritative DC, and no new 2213 or 4012.
- Create a test file in the domain's
scriptsfolder on one DC and confirm it appears on the others, then delete it. - On a client that logged Group Policy event 1058,
gpupdate /forcenow succeeds; see the Group Policy processing errors reference.
Related: AD replication errors (DFSR needs AD replication to deliver its configuration) and Directory Service, Netlogon and DNS events.
