Home
%3CLINGO-SUB%20id%3D%22lingo-sub-425405%22%20slang%3D%22en-US%22%3EStreamlined%20Migration%20of%20FRS%20to%20DFSR%20SYSVOL%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-425405%22%20slang%3D%22en-US%22%3E%0A%20%26lt%3Bmeta%20http-equiv%3D%22Content-Type%22%20content%3D%22text%2Fhtml%3B%20charset%3DUTF-8%22%20%2F%26gt%3B%3CSTRONG%3EFirst%20published%20on%20TECHNET%20on%20Jun%2025%2C%202014%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%20Hi%20folks%2C%20%3CA%20href%3D%22https%3A%2F%2Ftwitter.com%2Fnerdpyle%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Ned%20%3C%2FA%3E%20here%20again.%20When%20telling%20people%20about%20the%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Fb%2Ffilecab%2Farchive%2F2014%2F06%2F25%2Fthe-end-is-nigh-for-frs.aspx%22%20target%3D%22_blank%22%3E%20coming%20removal%20of%20FRS%20from%20Windows%20Server%20%3C%2FA%3E%20%2C%20the%20main%20response%20is%20usually%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3E%3CI%3E%20%E2%80%9CSure%2C%20I%20have%20occasional%20problems%20with%20FRS%20and%20know%20that%20I%20should%20upgrade%20to%20DFSR%2C%20but%20who%20has%20the%20time%20for%20a%20huge%20migration%3F%20That%20guide%20is%20very%20intimidating!%E2%80%9D%20%3C%2FI%3E%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20%3CSTRONG%3E%20Update%20June%2020%2C%202017%3A%20It%20is%20done%3B%20Windows%20Server%202016%20RS1%20is%20the%20last%20version%20that%20will%20allow%20FRS%20-%20RS3%20no%20longer%20includes%20the%20binaries.%20%3C%2FSTRONG%3E%20%3CA%20href%3D%22https%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4025991%2Fwindows-server-2016-rs3-no-longer-supports-frs%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.microsoft.com%2Fen-us%2Fhelp%2F4025991%2Fwindows-server-2016-rs3-no-longer-supports-frs%20%3C%2FA%3E%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20I%20hear%20you%20on%20the%20%3CA%20href%3D%22http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fdd640019(v%3DWS.10).aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20guide%20%3C%2FA%3E%20%3B%20it%20is%20%3CA%20href%3D%22http%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fdownload%2Fdetails.aspx%3Fid%3D4843%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%2052%20pages%20%3C%2FA%3E%20of%20verbosity%20and%20completeness.%20This%20implies%20that%20migration%20normally%20takes%20weeks%20or%20months%20though%2C%20which%20is%20untrue.%20With%20smaller%20domains%2C%20it%20should%20take%20a%20few%20minutes%2C%20and%20with%20larger%20ones%2C%20a%20few%20hours%20or%20days%20at%20most.%20Migrations%20are%20staged%2C%20with%20no%20interruption%20to%20users%2C%20and%20can%20be%20rolled%20back%20until%20completed.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20Today%20I%E2%80%99ll%20talk%20about%20how%20to%20migrate%20using%20one%20of%20three%20streamlined%20methodologies%3A%20%3CBR%20%2F%3E%3CUL%3E%3CBR%20%2F%3E%3CLI%3E%3CA%20href%3D%22%23quick%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSTRONG%3EQuick%20%3C%2FSTRONG%3E%20Migration%20%3C%2FA%3E%20(where%20you%20don%E2%80%99t%20know%20if%20your%20domain%20controllers%20are%20healthy%2C%20and%20you%20want%20a%20rollback%20option)%3C%2FLI%3E%3CBR%20%2F%3E%3CLI%3E%3CA%20href%3D%22%23express%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSTRONG%3EExpress%20%3C%2FSTRONG%3E%20Migration%20%3C%2FA%3E%20(where%20you%20are%20sure%20that%20your%20domain%20controllers%20are%20healthy%2C%20and%20you%20want%20a%20rollback%20option)%3C%2FLI%3E%3CBR%20%2F%3E%3CLI%3E%3CA%20href%3D%22%23hyper%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSTRONG%3EHyper%20%3C%2FSTRONG%3E%20Migration%20%3C%2FA%3E%20(where%20you%20want%20to%20migrate%20with%20the%20minimum%20steps%20and%20are%20confident%20of%20domain%20controller%20health)%3C%2FLI%3E%3CBR%20%2F%3E%3C%2FUL%3E%3CBR%20%2F%3E%20Before%20I%20start%3A%20we%20still%20recommend%20that%20you%20review%20the%20full%20%3CA%20href%3D%22http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fdd640019(v%3DWS.10).aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20migration%20guide%20%3C%2FA%3E%20to%20understand%20all%20the%20requirements%20and%20how%20DFSR%20SYSVOL%20migration%20works.%20It%20might%20add%20a%20few%20hours%20of%20reading%2C%20but%20it%E2%80%99s%20all%20in%20the%20name%20of%20prudence%20and%20understanding.%20This%20blog%20post%20doesn%E2%80%99t%20really%20explain%20anything%3B%20it%20just%20punches%20you%20through%20to%20the%20other%20side.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20Still%20here%3F%20Ok%2C%20let%E2%80%99s%20get%20started.%20%3CBR%20%2F%3E%3CH2%20id%3D%22toc-hId-1703839298%22%20id%3D%22toc-hId-1730589906%22%20id%3D%22toc-hId-1730589906%22%20id%3D%22toc-hId-1730589906%22%20id%3D%22toc-hId-1730589906%22%20id%3D%22toc-hId-1730589906%22%20id%3D%22toc-hId-1730589906%22%20id%3D%22toc-hId-1730589906%22%20id%3D%22toc-hId-1730589906%22%20id%3D%22toc-hId-1730589906%22%20id%3D%22toc-hId-1730589906%22%20id%3D%22toc-hId-1730589906%22%20id%3D%22toc-hId-1730589906%22%20id%3D%22toc-hId-1730589906%22%20id%3D%22toc-hId-1730589906%22%3EAssumptions%3C%2FH2%3E%3CBR%20%2F%3E%201.%20You%20already%20know%20your%20way%20around%20Active%20Directory%20and%20SYSVOL.%20If%20you%20are%20new%20to%20these%20technologies%2C%20stop%20reading%20this%20blog%20post%20and%20use%20the%20%3CA%20href%3D%22http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fdd640019(v%3DWS.10).aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20DFSR%20SYSVOL%20migration%20guide%20%3C%2FA%3E%20for%20your%20migration%20instead.%20It%E2%80%99s%20much%20more%20comprehensive.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%202.%20You%20already%20deployed%20%3CI%3E%20at%20least%20%3C%2FI%3E%20Windows%20Server%202008%20to%20%3CI%3E%20all%20%3C%2FI%3E%20domain%20controllers%20in%20the%20domain%20and%20there%20are%20%3CI%3E%20no%20%3C%2FI%3E%20remaining%20Windows%20Server%202003%20or%20Windows%20Server%202003%20R2%20domain%20controllers.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%203.%20%3CEM%3EIf%20using%20Windows%20Server%202008%20or%20Windows%20Server%202008%20R2%20%3C%2FEM%3E%20domain%20controllers%2C%20you%20have%20deployed%20the%20latest%20version%20of%20%3CB%3E%20Robocopy.exe%20%3C%2FB%3E%20.%20The%20latest%20WS2008%20version%20as%20of%20this%20writing%20is%20%3CA%20href%3D%22http%3A%2F%2Fsupport.microsoft.com%2Fkb%2F2644882%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20KB2644882%20%3C%2FA%3E%20%3B%20the%20latest%20WS2008%20R2%20is%20%3CA%20href%3D%22http%3A%2F%2Fsupport.microsoft.com%2Fkb%2F2646535%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20KB2646535%20%3C%2FA%3E%20).%20This%20is%20an%20%3CI%3E%20optional%20but%20recommended%20%3C%2FI%3E%20step%20%3CI%3E%20%3B%20%3C%2FI%3E%20it%20ensures%20efficient%20preseeding%20of%20data%20during%20the%20migration%2C%20but%20migration%20still%20works%20even%20without%20them.%20If%20using%20Windows%20Server%202012%20or%20later%20operating%20systems%2C%20there%E2%80%99s%20no%20need%20to%20update%20robocopy.%20For%20more%20information%2C%20review%20%3CA%20href%3D%22http%3A%2F%2Fsupport.microsoft.com%2Fkb%2F2567421%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20KB2567421%20%3C%2FA%3E%20.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%204.%20You%20already%20raised%20the%20domain%20functional%20level%20to%20%3CI%3E%20at%20least%20%3C%2FI%3E%20Windows%20Server%202008%2C%20using%20%3CA%20href%3D%22http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fcc753104.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Domain.msc%20%3C%2FA%3E%20or%20the%20%3CA%20href%3D%22http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fhh852281.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Set-ADDomainMode%20%3C%2FA%3E%20Windows%20PowerShell%20cmdlet.%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F107289i501B7D6F57C5C853%22%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%3CBLOCKQUOTE%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F107290iBEF82EA3B4665FBB%22%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%3CH2%20id%3D%22toc-hId--848317663%22%20id%3D%22toc-hId--821567055%22%20id%3D%22toc-hId--821567055%22%20id%3D%22toc-hId--821567055%22%20id%3D%22toc-hId--821567055%22%20id%3D%22toc-hId--821567055%22%20id%3D%22toc-hId--821567055%22%20id%3D%22toc-hId--821567055%22%20id%3D%22toc-hId--821567055%22%20id%3D%22toc-hId--821567055%22%20id%3D%22toc-hId--821567055%22%20id%3D%22toc-hId--821567055%22%20id%3D%22toc-hId--821567055%22%20id%3D%22toc-hId--821567055%22%20id%3D%22toc-hId--821567055%22%3ESome%20handy%20advice%20before%20you%20begin%3C%2FH2%3E%3CBR%20%2F%3E%20For%20faster%20migration%20performance%2C%20be%20aware%20of%20how%20to%20make%20AD%20performance%20faster%20-%20%3CA%20href%3D%22http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fcc835086.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20%3CB%3E%20Repadmin.exe%20%3C%2FB%3E%20%2Fsyncall%20%3C%2FA%3E%20and%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Fb%2Fqzaidi%2Farchive%2F2010%2F09%2F23%2Fenable-change-notifications-between-sites-how-and-why.aspx%22%20target%3D%22_blank%22%3E%20change%20notification%20%3C%2FA%3E%20are%20your%20friends%2C%20but%20like%20the%20robocopy%20patches%20above%2C%20are%20optional.%20DFSR%20migration%20only%20goes%20as%20fast%20as%20AD%20replication.%20For%20instance%2C%20this%20command%20will%20force%20push%20replication%20of%20all%20partitions%20while%20ignoring%20the%20schedules%20(this%20is%20a%20rather%20sledgehammer%20example)%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3ERepadmin%20%2Fsyncall%20%2Fforce%20%2FAPed%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20Furthermore%2C%20DFSR%20SYSVOL%20only%20replicates%20when%20AD%20has%20an%20open%20schedule%20(DFSR%20does%20not%20know%20about%20change%20notification).%20Ensure%20you%20have%20configured%20AD%20site%20links%20for%20continuous%20replication%2C%20if%20you%20want%20DFSR%20to%20replicate%20as%20fast%20as%20change%20notification.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20Finally%2C%20DFSR%20reads%20and%20writes%20its%20new%20migration%20state%20every%205%20minutes%20on%20each%20DC.%20You%20can%20speed%20this%20up%20by%20using%20%3CB%3E%20Dfsrdiag.exe%20pollad%20%3C%2FB%3E%20or%20the%20new%20%3CA%20href%3D%22http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fdn296560.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Update-DfsrConfigurationFromAD%20%3C%2FA%3E%20Windows%20PowerShell%20cmdlet%20(if%20all%20your%20DCs%20are%20running%20Windows%20Server%202012%20R2).%20For%20the%20latter%2C%20a%20slick%20way%20to%20update%20every%20DC%20in%20the%20domain%20at%20once%20is%20to%20combine%20with%20the%20AD%20cmdlets%20(this%20sample%20is%20a%20single%20wrapped%20line)%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3EGet-ADDomainController%20-Server%20%3CI%3E%20corp.contoso.com%20%3C%2FI%3E%20-Filter%20*%20%7C%20%25%20%7B%20Update-DfsrConfigurationFromAD%20-ComputerName%20%24_.name%20-Verbose%20%7D%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20Once%20you%20start%20the%20migration%2C%20running%20%3CSTRONG%3E%20repadmin%20%3C%2FSTRONG%3E%20forced%20syncs%20and%20%3CSTRONG%3E%20dfsrdiag%20%3C%2FSTRONG%3E%20forced%20polls%20after%20each%20migration%20step%20will%20greatly%20speed%20up%20the%20processing.%20Or%20you%20can%20just%20wait%20and%20let%20things%20happen%20naturally%20-%20that%E2%80%99s%20fine%20too.%20%3CBR%20%2F%3E%3CH2%20id%3D%22toc-hId-894492672%22%20id%3D%22toc-hId-921243280%22%20id%3D%22toc-hId-921243280%22%20id%3D%22toc-hId-921243280%22%20id%3D%22toc-hId-921243280%22%20id%3D%22toc-hId-921243280%22%20id%3D%22toc-hId-921243280%22%20id%3D%22toc-hId-921243280%22%20id%3D%22toc-hId-921243280%22%20id%3D%22toc-hId-921243280%22%20id%3D%22toc-hId-921243280%22%20id%3D%22toc-hId-921243280%22%20id%3D%22toc-hId-921243280%22%20id%3D%22toc-hId-921243280%22%20id%3D%22toc-hId-921243280%22%3E%3CA%20id%3D%22quick%22%20target%3D%22_blank%22%3E%20%3C%2FA%3E%20Quick%20Migration%3C%2FH2%3E%3CBR%20%2F%3E%20In%20this%20case%2C%20the%20health%20of%20AD%20and%20SYSVOL%20on%20all%20domain%20controllers%20is%20not%20known.%20For%20instance%2C%20you%20are%20not%20using%20System%20Center%20Operations%20Manager%20to%20monitor%20your%20domain%20controllers%20for%20AD%20replication%2C%20SYSVOL%20availability%2C%20and%20free%20disk%20space.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20The%20goal%20of%20the%20Quick%20Migration%20scenario%20is%20to%20test%20the%20conditions%20of%20the%20domain%20controllers%2C%20then%20migrate%20SYSVOL%20to%20DFSR%2C%20with%20the%20ability%20to%20roll%20back%20during%20the%20process.%20%3CB%3E%20%3C%2FB%3E%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20%3CSTRONG%3E%201.%20%3C%2FSTRONG%3E%20%3CB%3EEnsure%20free%20disk%20space%20%3C%2FB%3E%20-%20The%20DFSR%20migration%20process%20copies%20the%20contents%20of%20SYSVOL%20to%20a%20parallel%20folder%20called%20SYSVOL_DFSR%2C%20and%20then%20shares%20out%20that%20copy%20during%20the%20Redirection%20phase.%20This%20means%20that%20on%20the%20volume%20where%20your%20SYSVOL%20exists%20on%20domain%20controllers%20-%20typically%20the%20C%3A%20drive%20-%20you%20need%20at%20least%20as%20much%20free%20space%20as%20the%20size%20of%20the%20current%20SYSVOL%20folder%2C%20plus%20a%2010%25%20fudge%20factor.%20For%20instance.%2C%20if%20your%20current%20SYSVOL%20folder%20is%202GB%20(an%20unusually%20large%20SYSVOL)%2C%20you%20should%20ensure%20that%20at%20least%202.2%20GB%20disk%20space%20is%20free%20on%20the%20same%20volume.%20Most%20SYSVOL%20are%20only%20a%20few%20hundred%20MB%20or%20less.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20An%20easy%20way%20to%20determine%20the%20free%20disk%20space%20on%20a%20bunch%20of%20remote%20DCs%20is%20with%20%3CB%3E%20Psinfo.exe%20-d%20%3C%2FB%3E%20.%20Look%20%3CA%20href%3D%22http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Fsysinternals%2Fbb897550.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20here%20%3C%2FA%3E%20for%20more%20info.%20The%20WMI%20%3CB%3E%20Win32_LogicalDisk%20%3C%2FB%3E%20class%20is%20also%20a%20possibility%2C%20such%20as%20through%20Windows%20PowerShell%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3EGet-WmiObject%20-Class%20win32_logicaldisk%20-ComputerName%20%3CI%3E%20srv01%2Csrv02%2Csrv03%20%3C%2FI%3E%20%7C%20FT%20systemname%2Cdeviceid%2Cfreespace%20-auto%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20You%20can%20get%20fancier%20here%2C%20first%20looking%20on%20each%20computer%20to%20decide%20which%20volume%20hosts%20SYSVOL%20and%20comparing%20sizes%20and%20such%2C%20but%20this%20is%20the%20%3CI%3E%20quick%20%3C%2FI%3E%20migration%20guide!%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20Note%3A%20you%20can%20greatly%20decrease%20the%20size%20of%20your%20SYSVOL%20by%20preventing%20legacy%20ADM%20replication%20using%20%3CA%20href%3D%22http%3A%2F%2Fsupport.microsoft.com%2Fkb%2F813338%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20KB813338%20%3C%2FA%3E%20.%20%3CB%3E%20%3C%2FB%3E%20A%20hundred%20group%20policies%20with%2050%20registry%20settings%20apiece%20is%20unlikely%20to%20exceed%205MB%20total%20when%20creating%20group%20policies%20using%20Windows%20Vista%20or%20later.%20The%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Fb%2Faskds%2Farchive%2F2009%2F12%2F09%2Fwindows-7-windows-server-2008-r2-and-the-group-policy-central-store.aspx%22%20target%3D%22_blank%22%3E%20ADMX%20central%20store%20and%20alternatives%20%3C%2FA%3E%20are%20available%20for%20servicing.%20%3CB%3E%20%3C%2FB%3E%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20%3CSTRONG%3E%202.%20%3C%2FSTRONG%3E%20%3CB%3EEnsure%20correct%20security%20policy%20%3C%2FB%3E%20-%20You%20must%20ensure%20that%20the%20built-in%20Administrators%20group%20has%20the%20%E2%80%9CManage%20Auditing%20and%20Security%20Log%E2%80%9D%20user%20right%20on%20all%20your%20domain%20controllers.%20This%20is%20on%20by%20default%2C%20so%20if%20it%E2%80%99s%20not%20set%2C%20someone%20yanked%20it.%20Microsoft%20does%20not%20support%20removing%20that%2C%20no%20matter%20what%20you%20may%20have%20read%20elsewhere.%20To%20validate%2C%20examine%20the%20group%20policy%20applied%20to%20your%20domain%20controllers%20by%20using%20Gpresult.exe.%20For%20more%20info%2C%20examine%20%3CA%20href%3D%22http%3A%2F%2Fsupport.microsoft.com%2Fkb%2F2567421%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20KB2567421%20%3C%2FA%3E%20.%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F107291i3A8BE17050818A4A%22%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20%3CSTRONG%3E%203.%20Ensure%20AD%20replication%20is%20working%20%3C%2FSTRONG%3E%20-%20The%20DFSR%20migration%20depends%20entirely%20on%20each%20domain%20controller%20receiving%20and%20sending%20state%20changes%20via%20AD%20replication.%20There%20are%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Fb%2Faskds%2Farchive%2F2009%2F07%2F01%2Fgetting-over-replmon.aspx%22%20target%3D%22_blank%22%3E%20many%20ways%20%3C%2FA%3E%20to%20examine%20AD%20health%2C%20but%20the%20easiest%20is%20probably%20the%20%3CA%20href%3D%22http%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fdownload%2Fdetails.aspx%3Fid%3D30005%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Active%20Directory%20Replication%20Status%20Tool%20%3C%2FA%3E%20.%20Install%20the%20utility%20and%20scan%20your%20domain%20for%20errors%3B%20if%20there%20are%20problems%2C%20fix%20them%20and%20then%20continue.%20Don%E2%80%99t%20attempt%20a%20DFSR%20migration%20unless%20all%20your%20domain%20controllers%20are%20replicating%20AD%20correctly.%20%3CB%3E%20%3C%2FB%3E%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F107292i06FFFDFB5288363D%22%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20Ideally%2C%20when%20you%20set%20%E2%80%9CErrors%20Only%E2%80%9D%20mode%20on%2C%20it%20looks%20like%20this%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F107293i92BAC96BC6F27F46%22%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%3CBLOCKQUOTE%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F107294i7BFD0DB612B276B4%22%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20%3CB%3E%204.%20%3C%2FB%3E%20%3CB%3EEnsure%20SYSVOL%20is%20shared%20%3C%2FB%3E%20-%20DFSR%20migration%20naturally%20depends%20on%20SYSVOL%20itself%3B%20it%20must%20already%20be%20shared%20and%20the%20DC%20must%20be%20advertising%20and%20available%2C%20or%20migration%20at%20each%20stage%20will%20never%20complete.%20The%20simplest%20way%20to%20check%20all%20your%20domain%20controllers%20is%20with%20the%20%3CB%3E%20Dcdiag.exe%20%3C%2FB%3E%20command%20using%20two%20specific%20tests%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3EDcdiag%20%2Fe%20%2Ftest%3Asysvolcheck%20%2Ftest%3Aadvertising%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20Don%E2%80%99t%20attempt%20a%20DFSR%20migration%20unless%20all%20your%20domain%20controllers%20are%20passing%20the%20connectivity%2C%20SYSVOL%2C%20and%20advertising%20tests%20with%20no%20errors.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20They%20should%20look%20like%20this%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F107295i968E61DBD8F72DF3%22%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20%3CB%3E%205.%20%3C%2FB%3E%20%3CB%3EMigrate%20to%20Prepared%20State%20%3C%2FB%3E%20-%20Now%20you%20will%20migrate%20to%20the%20Prepared%20state%2C%20where%20both%20FRS%20and%20DFSR%20are%20replicating%20their%20own%20individual%20copies%20of%20SYSVOL%2C%20but%20the%20FRS%20copy%20mounts%20the%20SYSVOL%20and%20Netlogon%20shares.%20On%20the%20PDC%20Emulator%20domain%20controller%2C%20run%20(as%20an%20elevated%20domain%20admin)%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3EDfsrmig%20%2Fsetglobalstate%201%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20Now%20you%20wait%20for%20this%20AD%20value%20on%20the%20PDCE%20to%20converge%20on%20all%20domain%20controllers%2C%20then%20for%20DFSR%20to%20switch%20to%20Prepared%20state%20on%20each%20domain%20controller%20and%20update%20AD%2C%20and%20finally%20for%20that%20value%20to%20replicate%20back%20to%20the%20PDCE.%20Use%20the%20following%20command%20to%20see%20progress%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3EDfsrmig%20%2Fgetmigrationstate%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20When%20all%20DCs%20are%20ready%2C%20the%20output%20will%20look%20like%20this%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F107296i6EF5AA7C2C0A6F17%22%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20As%20I%20mentioned%20in%20the%20advice%20section%2C%20you%20can%20speed%20this%20processing%20up%20with%20faster%20AD%20replication%20and%20DFSR%20polling.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20%3CB%3E%206.%20%3C%2FB%3E%20%3CB%3EMigrate%20to%20Redirected%20State%20-%20%3C%2FB%3E%20Now%20you%20will%20migrate%20to%20the%20Redirected%20state%2C%20where%20both%20FRS%20and%20DFSR%20are%20replicating%20their%20own%20individual%20copies%20of%20SYSVOL%2C%20but%20the%20DFSR%20copy%20mounts%20the%20SYSVOL%20and%20Netlogon%20shares.%20On%20the%20PDC%20Emulator%20domain%20controller%2C%20run%20(as%20an%20elevated%20domain%20admin)%3A%20%3CB%3E%20%3C%2FB%3E%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3EDfsrmig%20%2Fsetglobalstate%202%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20Now%20you%20wait%20for%20this%20AD%20value%20on%20the%20PDCE%20to%20converge%20on%20all%20domain%20controllers%2C%20then%20for%20DFSR%20to%20switch%20to%20Redirected%20state%20on%20each%20domain%20controller%20and%20update%20AD%2C%20and%20finally%20for%20that%20value%20to%20replicate%20back%20to%20the%20PDCE.%20Use%20the%20following%20command%20to%20see%20progress%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3EDfsrmig%20%2Fgetmigrationstate%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20When%20all%20DCs%20are%20ready%2C%20the%20output%20will%20look%20like%20this%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F107297i08BE9EE523893FFE%22%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20%3CB%3E%207.%20%3C%2FB%3E%20%3CB%3EMigrate%20to%20Eliminated%20State%20-%20%3C%2FB%3E%20Finally%2C%20you%20will%20migrate%20to%20the%20Eliminated%20state%2C%20where%20DFSR%20is%20replicating%20SYSVOL%20and%20FRS%20is%20removed.%20Unlike%20the%20Prepared%20and%20Redirected%20states%2C%20there%20is%20no%20way%20to%20go%20backwards%20from%20this%20step%20-%20once%20executed%2C%20FRS%20is%20permanently%20stopped%20and%20cannot%20be%20configured%20again.%20On%20the%20PDC%20Emulator%20domain%20controller%2C%20run%20(as%20an%20elevated%20domain%20admin)%3A%20%3CB%3E%20%3C%2FB%3E%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3EDfsrmig%20%2Fsetglobalstate%203%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20Now%20you%20wait%20for%20this%20AD%20value%20on%20the%20PDCE%20to%20converge%20on%20all%20domain%20controllers%2C%20then%20for%20DFSR%20to%20switch%20to%20Eliminated%20state%20on%20each%20domain%20controller%20and%20update%20AD%2C%20and%20finally%20for%20that%20value%20to%20replicate%20back%20to%20the%20PDCE.%20Use%20the%20following%20command%20to%20see%20progress%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3EDfsrmig%20%2Fgetmigrationstate%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20When%20all%20DCs%20are%20ready%2C%20the%20output%20will%20look%20like%20this%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F107298iAAB688A34101C535%22%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20Your%20migration%20is%20complete.%20%3CBR%20%2F%3E%3CH2%20id%3D%22toc-hId--1657664289%22%20id%3D%22toc-hId--1630913681%22%20id%3D%22toc-hId--1630913681%22%20id%3D%22toc-hId--1630913681%22%20id%3D%22toc-hId--1630913681%22%20id%3D%22toc-hId--1630913681%22%20id%3D%22toc-hId--1630913681%22%20id%3D%22toc-hId--1630913681%22%20id%3D%22toc-hId--1630913681%22%20id%3D%22toc-hId--1630913681%22%20id%3D%22toc-hId--1630913681%22%20id%3D%22toc-hId--1630913681%22%20id%3D%22toc-hId--1630913681%22%20id%3D%22toc-hId--1630913681%22%20id%3D%22toc-hId--1630913681%22%3E%3CA%20id%3D%22express%22%20target%3D%22_blank%22%3E%20%3C%2FA%3E%20Express%20Migration%3C%2FH2%3E%3CBR%20%2F%3E%20In%20this%20case%2C%20the%20health%20of%20AD%20and%20SYSVOL%20on%20all%20domain%20controllers%20is%20known%20to%20be%20healthy.%20For%20instance%2C%20you%20are%20using%20System%20Center%20Operations%20Manager%20to%20monitor%20your%20domain%20controllers%20and%20ensure%20that%20AD%20replication%2C%20SYSVOL%20availability%2C%20and%20free%20disk%20space%20are%20all%20nominal.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20The%20goal%20of%20the%20Express%20Migration%20scenario%20is%20to%20migrate%20SYSVOL%20to%20DFSR%20with%20the%20ability%20to%20roll%20back%20during%20the%20process.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20%3CSTRONG%3E%201.%20%3C%2FSTRONG%3E%20%3CB%3EEnsure%20correct%20security%20policy%20-%20%3C%2FB%3E%20You%20must%20ensure%20that%20the%20built-in%20Administrators%20group%20has%20the%20%E2%80%9CManage%20Auditing%20and%20Security%20Log%E2%80%9D%20user%20right%20on%20all%20your%20domain%20controllers.%20This%20is%20on%20by%20default%2C%20so%20if%20it%E2%80%99s%20not%20set%2C%20someone%20yanked%20it.%20Microsoft%20does%20not%20support%20removing%20that%2C%20no%20matter%20what%20you%20may%20have%20read%20elsewhere.%20To%20validate%2C%20examine%20the%20group%20policy%20applied%20to%20your%20domain%20controllers%20by%20using%20%3CB%3E%20Gpresult.exe%20%3C%2FB%3E%20.%20For%20more%20info%2C%20examine%20KB2567421%20.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20%3CB%3E%202.%20%3C%2FB%3E%20Migrate%20to%20Prepared%20State%20-%20Now%20you%20will%20migrate%20to%20the%20Prepared%20state%2C%20where%20both%20FRS%20and%20DFSR%20are%20replicating%20their%20own%20individual%20copies%20of%20SYSVOL%2C%20but%20the%20FRS%20copy%20mounts%20the%20SYSVOL%20and%20Netlogon%20shares.%20On%20the%20PDC%20Emulator%20domain%20controller%2C%20run%20(as%20an%20elevated%20domain%20admin)%3A%20%3CB%3E%20%3C%2FB%3E%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3EDfsrmig%20%2Fsetglobalstate%201%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20Now%20you%20wait%20for%20this%20AD%20value%20on%20the%20PDCE%20to%20converge%20on%20all%20domain%20controllers%2C%20then%20for%20DFSR%20to%20switch%20to%20Prepared%20state%20on%20each%20domain%20controller%20and%20update%20AD%2C%20and%20finally%20for%20that%20value%20to%20replicate%20back%20to%20the%20PDCE.%20Use%20the%20following%20command%20to%20see%20progress%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3EDfsrmig%20%2Fgetmigrationstate%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20When%20all%20DCs%20are%20ready%2C%20the%20output%20will%20look%20like%20this%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F107299iE4EB904E3C548B8B%22%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20As%20I%20mentioned%20in%20the%20advice%20section%2C%20you%20can%20speed%20this%20processing%20up%20with%20faster%20AD%20replication%20and%20polling.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20%3CB%3E%203.%20%3C%2FB%3E%20%3CB%3EMigrate%20to%20Redirected%20State%20-%20%3C%2FB%3E%20Now%20you%20will%20migrate%20to%20the%20Redirected%20state%2C%20where%20both%20FRS%20and%20DFSR%20are%20replicating%20their%20own%20individual%20copies%20of%20SYSVOL%2C%20but%20the%20DFSR%20copy%20mounts%20the%20SYSVOL%20and%20Netlogon%20shares.%20On%20the%20PDC%20Emulator%20domain%20controller%2C%20run%20(as%20an%20elevated%20domain%20admin)%3A%20%3CB%3E%20%3C%2FB%3E%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3EDfsrmig%20%2Fsetglobalstate%202%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20Now%20you%20wait%20for%20this%20AD%20value%20on%20the%20PDCE%20to%20converge%20on%20all%20domain%20controllers%2C%20then%20for%20DFSR%20to%20switch%20to%20Redirected%20state%20on%20each%20domain%20controller%20and%20update%20AD%2C%20and%20finally%20for%20that%20value%20to%20replicate%20back%20to%20the%20PDCE.%20Use%20the%20following%20command%20to%20see%20progress%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3EDfsrmig%20%2Fgetmigrationstate%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20When%20all%20DCs%20are%20ready%2C%20the%20output%20will%20look%20like%20this%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F107300i395322BEFA45E715%22%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20%3CB%3E%204.%20%3C%2FB%3E%20%3CB%3EMigrate%20to%20Eliminated%20State%20-%20%3C%2FB%3E%20Finally%2C%20you%20will%20migrate%20to%20the%20Eliminated%20state%2C%20where%20DFSR%20is%20replicating%20SYSVOL%20and%20FRS%20is%20removed.%20Unlike%20the%20Prepared%20and%20Redirected%20states%2C%20there%20is%20no%20way%20to%20go%20backwards%20from%20this%20step%20-%20once%20executed%2C%20FRS%20is%20permanently%20stopped%20and%20cannot%20be%20configured%20again.%20On%20the%20PDC%20Emulator%20domain%20controller%2C%20run%20(as%20an%20elevated%20domain%20admin)%3A%20%3CB%3E%20%3C%2FB%3E%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3EDfsrmig%20%2Fsetglobalstate%203%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20Now%20you%20wait%20for%20this%20AD%20value%20on%20the%20PDCE%20to%20converge%20on%20all%20domain%20controllers%2C%20then%20for%20DFSR%20to%20switch%20to%20Eliminated%20state%20on%20each%20domain%20controller%20and%20update%20AD%2C%20and%20finally%20for%20that%20value%20to%20replicate%20back%20to%20the%20PDCE.%20Use%20the%20following%20command%20to%20see%20progress%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3EDfsrmig%20%2Fgetmigrationstate%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20When%20all%20DCs%20are%20ready%2C%20the%20output%20will%20look%20like%20this%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F107301iF1E8344D206536EF%22%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20Your%20migration%20is%20complete.%20%3CBR%20%2F%3E%3CH2%20id%3D%22toc-hId-85146046%22%20id%3D%22toc-hId-111896654%22%20id%3D%22toc-hId-111896654%22%20id%3D%22toc-hId-111896654%22%20id%3D%22toc-hId-111896654%22%20id%3D%22toc-hId-111896654%22%20id%3D%22toc-hId-111896654%22%20id%3D%22toc-hId-111896654%22%20id%3D%22toc-hId-111896654%22%20id%3D%22toc-hId-111896654%22%20id%3D%22toc-hId-111896654%22%20id%3D%22toc-hId-111896654%22%20id%3D%22toc-hId-111896654%22%20id%3D%22toc-hId-111896654%22%20id%3D%22toc-hId-111896654%22%3E%3CA%20id%3D%22hyper%22%20target%3D%22_blank%22%3E%20%3C%2FA%3E%20Hyper%20Migration%3C%2FH2%3E%3CBR%20%2F%3E%20In%20this%20case%2C%20the%20health%20of%20AD%20and%20SYSVOL%20on%20all%20domain%20controllers%20is%20known%20to%20be%20healthy.%20For%20instance%2C%20you%20are%20using%20System%20Center%20Operations%20Manager%20to%20monitor%20your%20domain%20controllers%20and%20ensure%20that%20AD%20replication%2C%20SYSVOL%20availability%2C%20and%20free%20disk%20space%20are%20all%20nominal.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20The%20goal%20of%20the%20Hyper%20Migration%20scenario%20is%20to%20migrate%20SYSVOL%20to%20DFSR%20with%20the%20fewest%20steps%20and%20no%20ability%20to%20roll%20back%20the%20migration%20process%20once%20commenced.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20%3CSTRONG%3E1%20%3C%2FSTRONG%3E%20.%20%3CB%3EEnsure%20correct%20security%20policy%20-%20%3C%2FB%3E%20You%20must%20ensure%20that%20the%20built-in%20Administrators%20group%20has%20the%20%E2%80%9CManage%20Auditing%20and%20Security%20Log%E2%80%9D%20user%20right%20on%20all%20your%20domain%20controllers.%20This%20is%20on%20by%20default%2C%20so%20if%20it%E2%80%99s%20not%20set%2C%20someone%20yanked%20it.%20Microsoft%20does%20not%20support%20removing%20that%2C%20no%20matter%20what%20you%20may%20have%20read%20elsewhere.%20To%20validate%2C%20examine%20the%20group%20policy%20applied%20to%20your%20domain%20controllers%20using%20%3CB%3E%20Gpresult.exe%20%3C%2FB%3E%20.%20For%20more%20info%2C%20examine%20KB2567421%20.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20%3CB%3E%202.%20%3C%2FB%3E%20%3CB%3EMigrate%20to%20Eliminated%20State%20-%20%3C%2FB%3E%20DFSR%20does%20not%20mandate%20that%20you%20%3CI%3E%20must%20%3C%2FI%3E%20migrate%20through%20each%20stage%20at%20a%20time.%20If%20you%20wish%2C%20you%20can%20trigger%20migrating%20all%20the%20way%20to%20the%20Eliminated%20state%20immediately%2C%20where%20DFSR%20is%20replicating%20SYSVOL%20and%20FRS%20is%20removed.%20Unlike%20the%20incremental%20Prepared%20and%20Redirected%20states%2C%20there%20is%20no%20way%20to%20go%20backwards%20from%20this%20step%20-%20once%20executed%2C%20FRS%20is%20permanently%20stopped%20and%20cannot%20be%20configured%20again.%20On%20the%20PDC%20Emulator%20domain%20controller%2C%20run%20(as%20an%20elevated%20domain%20admin)%3A%20%3CB%3E%20%3C%2FB%3E%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3EDfsrmig%20%2Fsetglobalstate%203%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%3CBLOCKQUOTE%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F107302i626350A1334C5C53%22%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20Now%20you%20wait%20for%20this%20AD%20value%20on%20the%20PDCE%20to%20converge%20on%20all%20domain%20controllers%2C%20then%20for%20DFSR%20to%20switch%20to%20Eliminated%20state%20on%20each%20domain%20controller%20and%20update%20AD%2C%20and%20finally%20for%20that%20value%20to%20replicate%20back%20to%20the%20PDCE.%20This%20will%20happen%20for%20the%20Prepared%2C%20Redirected%2C%20and%20Eliminated%20stages%20sequentially%2C%20with%20no%20need%20to%20run%20each%20command.%20Use%20the%20following%20command%20to%20see%20progress%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3EDfsrmig%20%2Fgetmigrationstate%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20When%20all%20DCs%20are%20ready%2C%20the%20output%20will%20look%20like%20this%3A%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F107303iB7CFBE42E218A1E1%22%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CBR%20%2F%3E%20Your%20migration%20is%20complete.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20Naturally%2C%20anything%20faster%20than%20Hyper%20Migration%20requires%20your%20own%20Schwarzschild%20Wormhole.%20%3CBR%20%2F%3E%3CH2%20id%3D%22toc-hId-1827956381%22%20id%3D%22toc-hId-1854706989%22%20id%3D%22toc-hId-1854706989%22%20id%3D%22toc-hId-1854706989%22%20id%3D%22toc-hId-1854706989%22%20id%3D%22toc-hId-1854706989%22%20id%3D%22toc-hId-1854706989%22%20id%3D%22toc-hId-1854706989%22%20id%3D%22toc-hId-1854706989%22%20id%3D%22toc-hId-1854706989%22%20id%3D%22toc-hId-1854706989%22%20id%3D%22toc-hId-1854706989%22%20id%3D%22toc-hId-1854706989%22%20id%3D%22toc-hId-1854706989%22%20id%3D%22toc-hId-1854706989%22%3EFinal%20Notes%3C%2FH2%3E%3CBR%20%2F%3E%20Since%20you%20are%20probably%20new%20to%20SYSVOL%20using%20DFSR%20-%20and%20maybe%20DFSR%20in%20general%20-%20I%20highly%20recommend%20you%20review%20these%20two%20KB%20articles%3A%20%3CBR%20%2F%3E%3CUL%3E%3CBR%20%2F%3E%3CLI%3EKB2846759%20-%20%3CA%20href%3D%22http%3A%2F%2Fsupport.microsoft.com%2Fkb%2F2846759%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20DFSR%20event%20ID%202213%20in%20Windows%20Server%202008%20R2%20or%20Windows%20Server%202012%3C%2FA%3E%3C%2FLI%3E%3CBR%20%2F%3E%3CLI%3EKB2958414%20-%20%3CA%20href%3D%22http%3A%2F%2Fsupport.microsoft.com%2Fkb%2F2958414%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20DFS%20Replication%3A%20How%20to%20troubleshoot%20missing%20SYSVOL%20and%20Netlogon%20shares%3C%2FA%3E%3C%2FLI%3E%3CBR%20%2F%3E%3C%2FUL%3E%3CBR%20%2F%3E%20They%20cover%20the%20scenario%20where%20DFSR%20may%20pause%20replication%20-%20due%20to%20a%20power%20failure%20or%20hardware%20problem%20-%20and%20wait%20for%20you%20to%20manually%20resume%20it.%20This%20initially%20leads%20to%20group%20policy%20not%20replicating%2C%20but%20more%20importantly%2C%20eventually%20leads%20to%20a%20quarantined%20server.%20With%20our%20latest%20hotfixes%20and%20operating%20systems%2C%20Microsoft%20recommends%20disabling%20this%20pausing%20behavior%20and%20allow%20DFSR%20to%20resume.%20If%20using%20Windows%20Server%202008%20R2%20or%20Windows%20Server%202012%2C%20use%20KB2846759%20to%20always%20automatically%20resume%20replication%20(see%20section%20%E2%80%9CHow%20to%20disable%20the%20Stop%20Replication%20functionality%20in%20AutoRecovery%E2%80%9D).%20It%E2%80%99s%20a%20simple%20registry%20entry%2C%20and%20you%20can%20deploy%20it%20manually%20or%20using%20%3CA%20href%3D%22http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fcc771589.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Group%20Policy%20Preferences%20%3C%2FA%3E%20.%20Windows%20Server%202012%20R2%20and%20later%20default%20to%20auto-resuming%2C%20so%20there%20is%20nothing%20to%20do%20there.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20We%20went%20from%2052%20pages%20down%20to%20a%20handful%2C%20and%20that%20was%20with%20plenty%20of%20screenshots%20and%20blather.%20Now%20you%20are%20running%20DFSR%20for%20SYSVOL%20and%20prepared%20for%20the%20future%20of%20Windows%20Server.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20Until%20next%20time%2C%20%3CBR%20%2F%3E%3CBLOCKQUOTE%3E-%20%3CA%20href%3D%22https%3A%2F%2Ftwitter.com%2Fnerdpyle%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Ned%20%E2%80%9CEinstein%E2%80%93Rosen%20bridge%E2%80%9D%20Pyle%3C%2FA%3E%3C%2FBLOCKQUOTE%3E%0A%20%0A%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-425405%22%20slang%3D%22en-US%22%3EFirst%20published%20on%20TECHNET%20on%20Jun%2025%2C%202014%20Hi%20folks%2C%20Ned%20here%20again.%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-425405%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Edfsr%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Efile%20replication%20service%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Efrs%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMigration%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Esysvol%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EWindows%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-662808%22%20slang%3D%22en-US%22%3ERe%3A%20Streamlined%20Migration%20of%20FRS%20to%20DFSR%20SYSVOL%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-662808%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Ned%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAfter%20migrating%20to%20prepared%20state%20i%20run%20propagating%20test%20and%20see%20below%20error.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20889px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F116869i51C2DF912FE69041%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Propagation%20test%20failed.JPG%22%20title%3D%22Propagation%20test%20failed.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-729991%22%20slang%3D%22en-US%22%3ERe%3A%20Streamlined%20Migration%20of%20FRS%20to%20DFSR%20SYSVOL%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-729991%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20is%20AWESOME.%20I%20had%20been%20trying%20to%20migrate%20my%20DC%20on%20my%20home%2Foffice%20network%20and%20couldn't%20understand%20why%20I%20could%20join%20a%20new%20server%20to%20the%20domain%2C%20but%20couldn't%20get%20it%20to%20promote%20to%20DC.%20Very%20puzzling.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20worked%20like%20a%20charm%20and%20I've%20been%20able%20to%20complete%20my%20migration!%20Thanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-772703%22%20slang%3D%22en-US%22%3ERe%3A%20Streamlined%20Migration%20of%20FRS%20to%20DFSR%20SYSVOL%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-772703%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20for%20this!%26nbsp%3B%20That%20ridiculous%2052%20page%20novel%20was%20pretty%20bad.%26nbsp%3B%20You%20summed%20it%20up%20perfectly.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-662954%22%20slang%3D%22en-US%22%3ERe%3A%20Streamlined%20Migration%20of%20FRS%20to%20DFSR%20SYSVOL%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-662954%22%20slang%3D%22en-US%22%3E%3CP%3EI'd%20suggest%20asking%20a%20new%20forums%20question%20here%20rather%20than%20replying%20to%20blogs.%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FWindows-Server-for-IT-Pro%2Fbd-p%2FWindowsServer%22%20target%3D%22_blank%22%20rel%3D%22noopener%22%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FWindows-Server-for-IT-Pro%2Fbd-p%2FWindowsServer%3C%2FFONT%3E%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%26nbsp%3B%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%26nbsp%3B%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-776674%22%20slang%3D%22en-US%22%3ERe%3A%20Streamlined%20Migration%20of%20FRS%20to%20DFSR%20SYSVOL%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-776674%22%20slang%3D%22en-US%22%3E%3CP%3EHi.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20in%20big%20trouble.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CFONT%3EI%20only%20have%20one%202008%20R2%20DC%20on%20this%20domain%20(domain%20level%202008)%2C%20and%2C%20I%20am%20needing%20to%20migrate%20FRS%20to%20DFSR%20as%20I%20need%20to%20join%20a%202019%20server%20to%20the%20same%20domain%20and%20then%20demote%20the%20old%20one.%3CBR%20%2F%3EHowever%2C%20I'm%20stuck%20at%3A%3CBR%20%2F%3E%22Unable%20to%20create%20DFSR%20Migration%20log%20file.%20Error%205%20The%20following%20Domain%20Controllers%20are%20not%20in%20sync%20with%20Global%20state%20('Prepared')%3A%3CBR%20%2F%3EDomain%20Controller%20(Local%20Migration%20State)%20-%20DC%20Type%3CBR%20%2F%3E2008CSERVER%20('Start')%20-%20Primary%20DC%3CBR%20%2F%3EMigration%20has%20not%20yet%20reached%20a%20consistent%20state%20on%20all%20Domain%20Controllers.%20State%20information%20might%20be%20stale%20due%20to%20AD%20latency.%22%3CBR%20%2F%3EThere's%20enough%20free%20disk%2C%20the%20correct%20security%20policy%20for%20the%20built-in%20admins%20group%20is%20set%2C%20the%20AD%20Replication%20Tool%20shows%20no%20errors%20at%20all%2C%20nothing%20(not%20that%20there%20are%20any%20other%20DCs%20to%20replicate%20to%20anyway)%2C%20and%2C%20Dcdiag%20%2Fe%20%2Ftest%3Asysvolcheck%20%2Ftest%3Aadvertising%20is%20successful.%20(I%20went%20through%20all%20the%20steps%20in%20this%20article)%3C%2FFONT%3E%3C%2FP%3E%3CP%3E%3CFONT%3E%3CBR%20%2F%3EI%20then%20did%20Dfsrmig%20%2Fsetglobalstate%201%20but%20it's%20been%20three%20days%20now%20and%20I%20still%20get%20the%20error%20above.%3CBR%20%2F%3EAny%20thoughts%3F%3CBR%20%2F%3EA%20sysvol%20DFSR%20folder%20has%20already%20created%20inside%20the%20windows%2Fsysvol%20folder%2C%20shall%20I%20just%20try%20the%20nuclear%20option%20of%20Dfsrmig%20%2Fsetglobalstate%203%20%3F%3CBR%20%2F%3E%3CBR%20%2F%3E(I%20later%20tried%20that%2C%20and%2C%20while%20I%20was%20now%20able%20to%20join%20my%202019%20server%20to%20the%20domain%20because%20FRS%20was%20eliminated%2C%20my%20%22nuclear%22%20option%20is%20stuck%20at%20the%20following%20state%3A%20The%20following%20Domain%20Controllers%20are%20not%20in%20sync%20with%20Global%20state%20('Eliminated')%3A%3CBR%20%2F%3EDomain%20Controller%20(Local%20Migration%20State)%20-%20DC%20Type%3CBR%20%2F%3E2008CSERVER%20('Start')%20-%20Writable%20DC%20Migration%20has%20not%20yet%20reached%20a%20consistent%20state%20on%20all%20Domain%20Controllers.%20State%20information%20might%20be%20stale%20due%20to%20AD%20latency.)%3C%2FFONT%3E%3C%2FP%3E%3CP%3E%3CFONT%3E%3CBR%20%2F%3EDo%20I%20just%20do%20%2Fdeletenotntfrsmember%20now%3F%20Also%2C%20how%20do%20I%20test%20that%20this%20has%20worked%2C%20I%20mean%2C%20on%20my%20new%20DC%2C%20I've%20already%20transferred%20all%20FSMO%20roles%20to%20it%20and%20I%20can%20access%20AD%20and%20GPMC%20and%20so%20on%20but%20the%20sysvol%20folder%20is%20empty...%20Can%20I%20just%20manually%20copy%20everything%20from%20sysvol%20from%20the%20old%20DC%20(since%20there%20is%20only%20one)%20and%20then%20run%20%2Fdeletenotntfrsmember%20%3F%20(that%20server%20is%20going%20to%20be%20decommissioned%20anyway)%3C%2FFONT%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CFONT%3EI%20have%20a%20sysvol%20DFSR%20folder%20on%20the%20first%20(old)%20server%20now%2C%20and%20it's%20got%20all%20the%20policies%20in%20it%2C%20however%2C%20nothing%20replicating%20over%20to%20my%20new%202019%20DC%20which%20has%20a%20sysvol%20folder.%20(it's%20just%20empty)%3CBR%20%2F%3ESo%20do%20I%20just%20manually%20copy%20stuff%20into%20it%2C%20or%2C%20what%20do%20I%20do%3F%3C%2FFONT%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CFONT%3EI%20think%20this%20article%20is%20missing%20a%20step%20about%20checking%20something%2C%20as%2C%20I%20checked%20everything%20and%20it%20was%20all%20fine%20yet%20I%20was%20still%20stuck.%20This%20was%20all%20before%20the%202019%20server%20was%20promoted%20to%20being%20a%20DC.%3C%2FFONT%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CFONT%3E%3CFONT%3EI%20am%20decommissioning%20the%20old%20DC%20anyway%2C%20and%2C%20will%20have%20a%20new%20secondary%202019%20DC%20that%20I%20haven't%20even%20set%20up%20yet.%20If%20I%20just%20copy%20stuff%20manually%20into%20the%20empty%20DFSR%20folder%20on%20the%20current%20new%202019%20server%2C%20and%20then%20decommission%20the%202008%20r2%20one%2C%20will%20it%20then%20just%20work%20with%20a%20new%20secondary%202019%20server%3F%3C%2FFONT%3E%3C%2FFONT%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E(I've%20already%20transferred%20all%20the%20fsmo%20roles%20to%20the%20new%202019%20DC%2C%20do%20I%20have%20to%20transfer%20them%20back%20to%20the%20old%20one%20so%20as%20to%20be%20able%20to%20fix%20this%3F%3C%2FP%3E%3CP%3EI%20checked%20on%20the%202019%20DC%2C%20and%2C%20while%20I%20have%20now%20manually%20copied%20files%20over%20into%20the%20sysvol%20folder%2C%20it%20is%20not%20even%20shared%20on%20the%20network%2C%20if%20I%20do%20a%20%5C%5C2019dcserverhostname%2C%20there%20are%20no%20shares%20that%20appear%20at%20all%2C%20which%20is%20weird.)%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-781697%22%20slang%3D%22en-US%22%3ERe%3A%20Streamlined%20Migration%20of%20FRS%20to%20DFSR%20SYSVOL%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-781697%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F383409%22%20target%3D%22_blank%22%3E%40fgwefgyadfg%3C%2FA%3E%26nbsp%3Bneed%20to%20execute%20at%20elevated%20command%20prompt%2C%20run%20cmd%20as%20administrator%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-822840%22%20slang%3D%22en-US%22%3ERe%3A%20Streamlined%20Migration%20of%20FRS%20to%20DFSR%20SYSVOL%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-822840%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20a%20single%20forest%20tree%20composed%20of%201%20root%20and%201%20child%20domain.%3C%2FP%3E%3CP%3EDo%20I%20have%20to%20perform%20this%20operation%202%20times%3F%3C%2FP%3E%3CP%3E-%201%20in%20the%20root%26nbsp%3B%3C%2FP%3E%3CP%3E-%201%20in%20the%20child%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOr%20it%20is%20enough%201%20time.....%20utilizing%201%20enterprise%20domain%20account%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20just%20asking%20because%20I%20have%20performed%20this%20activity%20on%20the%20Root%20domain%20controller%20and%20when%20I%20run%20the%20%22%3CSTRONG%3Edfsrmig%20%2FGetMigrationState%22%26nbsp%3B%3C%2FSTRONG%3Eon%20the%20Child%20DC's%2C%20I%20get%20DFRS%20migration%20has%20not%20yet%20initialized.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20do%20I%20have%20to%20run%20that%20command%20in%20any%20domain%20of%20the%20forest%20tree%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EKind%20regards%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAP%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EKind%20regards%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAP%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Microsoft
First published on TECHNET on Jun 25, 2014
Hi folks, Ned here again. When telling people about the coming removal of FRS from Windows Server , the main response is usually:
“Sure, I have occasional problems with FRS and know that I should upgrade to DFSR, but who has the time for a huge migration? That guide is very intimidating!”

Update June 20, 2017: It is done; Windows Server 2016 RS1 is the last version that will allow FRS - RS3 no longer includes the binaries. https://support.microsoft.com/en-us/help/4025991/windows-server-2016-rs3-no-longer-supports-frs ...

I hear you on the guide ; it is 52 pages of verbosity and completeness. This implies that migration normally takes weeks or months though, which is untrue. With smaller domains, it should take a few minutes, and with larger ones, a few hours or days at most. Migrations are staged, with no interruption to users, and can be rolled back until completed.

Today I’ll talk about how to migrate using one of three streamlined methodologies:

  • Quick Migration (where you don’t know if your domain controllers are healthy, and you want a rollback option)

  • Express Migration (where you are sure that your domain controllers are healthy, and you want a rollback option)

  • Hyper Migration (where you want to migrate with the minimum steps and are confident of domain controller health)


Before I start: we still recommend that you review the full migration guide to understand all the requirements and how DFSR SYSVOL migration works. It might add a few hours of reading, but it’s all in the name of prudence and understanding. This blog post doesn’t really explain anything; it just punches you through to the other side.

Still here? Ok, let’s get started.

Assumptions


1. You already know your way around Active Directory and SYSVOL. If you are new to these technologies, stop reading this blog post and use the DFSR SYSVOL migration guide for your migration instead. It’s much more comprehensive.

2. You already deployed at least Windows Server 2008 to all domain controllers in the domain and there are no remaining Windows Server 2003 or Windows Server 2003 R2 domain controllers.

3. If using Windows Server 2008 or Windows Server 2008 R2 domain controllers, you have deployed the latest version of Robocopy.exe . The latest WS2008 version as of this writing is KB2644882 ; the latest WS2008 R2 is KB2646535 ). This is an optional but recommended step ; it ensures efficient preseeding of data during the migration, but migration still works even without them. If using Windows Server 2012 or later operating systems, there’s no need to update robocopy. For more information, review KB2567421 .

4. You already raised the domain functional level to at least Windows Server 2008, using Domain.msc or the Set-ADDomainMode Windows PowerShell cmdlet.


Some handy advice before you begin


For faster migration performance, be aware of how to make AD performance faster - Repadmin.exe /syncall and change notification are your friends, but like the robocopy patches above, are optional. DFSR migration only goes as fast as AD replication. For instance, this command will force push replication of all partitions while ignoring the schedules (this is a rather sledgehammer example):
Repadmin /syncall /force /APed

Furthermore, DFSR SYSVOL only replicates when AD has an open schedule (DFSR does not know about change notification). Ensure you have configured AD site links for continuous replication, if you want DFSR to replicate as fast as change notification.

Finally, DFSR reads and writes its new migration state every 5 minutes on each DC. You can speed this up by using Dfsrdiag.exe pollad or the new Update-DfsrConfigurationFromAD Windows PowerShell cmdlet (if all your DCs are running Windows Server 2012 R2). For the latter, a slick way to update every DC in the domain at once is to combine with the AD cmdlets (this sample is a single wrapped line):
Get-ADDomainController -Server corp.contoso.com -Filter * | % { Update-DfsrConfigurationFromAD -ComputerName $_.name -Verbose }

Once you start the migration, running repadmin forced syncs and dfsrdiag forced polls after each migration step will greatly speed up the processing. Or you can just wait and let things happen naturally - that’s fine too.

Quick Migration


In this case, the health of AD and SYSVOL on all domain controllers is not known. For instance, you are not using System Center Operations Manager to monitor your domain controllers for AD replication, SYSVOL availability, and free disk space.

The goal of the Quick Migration scenario is to test the conditions of the domain controllers, then migrate SYSVOL to DFSR, with the ability to roll back during the process.

1. Ensure free disk space - The DFSR migration process copies the contents of SYSVOL to a parallel folder called SYSVOL_DFSR, and then shares out that copy during the Redirection phase. This means that on the volume where your SYSVOL exists on domain controllers - typically the C: drive - you need at least as much free space as the size of the current SYSVOL folder, plus a 10% fudge factor. For instance., if your current SYSVOL folder is 2GB (an unusually large SYSVOL), you should ensure that at least 2.2 GB disk space is free on the same volume. Most SYSVOL are only a few hundred MB or less.

An easy way to determine the free disk space on a bunch of remote DCs is with Psinfo.exe -d . Look here for more info. The WMI Win32_LogicalDisk class is also a possibility, such as through Windows PowerShell:
Get-WmiObject -Class win32_logicaldisk -ComputerName srv01,srv02,srv03 | FT systemname,deviceid,freespace -auto

You can get fancier here, first looking on each computer to decide which volume hosts SYSVOL and comparing sizes and such, but this is the quick migration guide!

Note: you can greatly decrease the size of your SYSVOL by preventing legacy ADM replication using KB813338 . A hundred group policies with 50 registry settings apiece is unlikely to exceed 5MB total when creating group policies using Windows Vista or later. The ADMX central store and alternatives are available for servicing.

2. Ensure correct security policy - You must ensure that the built-in Administrators group has the “Manage Auditing and Security Log” user right on all your domain controllers. This is on by default, so if it’s not set, someone yanked it. Microsoft does not support removing that, no matter what you may have read elsewhere. To validate, examine the group policy applied to your domain controllers by using Gpresult.exe. For more info, examine KB2567421 .

3. Ensure AD replication is working - The DFSR migration depends entirely on each domain controller receiving and sending state changes via AD replication. There are many ways to examine AD health, but the easiest is probably the Active Directory Replication Status Tool . Install the utility and scan your domain for errors; if there are problems, fix them and then continue. Don’t attempt a DFSR migration unless all your domain controllers are replicating AD correctly.

Ideally, when you set “Errors Only” mode on, it looks like this:


4. Ensure SYSVOL is shared - DFSR migration naturally depends on SYSVOL itself; it must already be shared and the DC must be advertising and available, or migration at each stage will never complete. The simplest way to check all your domain controllers is with the Dcdiag.exe command using two specific tests:
Dcdiag /e /test:sysvolcheck /test:advertising

Don’t attempt a DFSR migration unless all your domain controllers are passing the connectivity, SYSVOL, and advertising tests with no errors.

They should look like this:

5. Migrate to Prepared State - Now you will migrate to the Prepared state, where both FRS and DFSR are replicating their own individual copies of SYSVOL, but the FRS copy mounts the SYSVOL and Netlogon shares. On the PDC Emulator domain controller, run (as an elevated domain admin):
Dfsrmig /setglobalstate 1

Now you wait for this AD value on the PDCE to converge on all domain controllers, then for DFSR to switch to Prepared state on each domain controller and update AD, and finally for that value to replicate back to the PDCE. Use the following command to see progress:
Dfsrmig /getmigrationstate

When all DCs are ready, the output will look like this:

As I mentioned in the advice section, you can speed this processing up with faster AD replication and DFSR polling.

6. Migrate to Redirected State - Now you will migrate to the Redirected state, where both FRS and DFSR are replicating their own individual copies of SYSVOL, but the DFSR copy mounts the SYSVOL and Netlogon shares. On the PDC Emulator domain controller, run (as an elevated domain admin):
Dfsrmig /setglobalstate 2

Now you wait for this AD value on the PDCE to converge on all domain controllers, then for DFSR to switch to Redirected state on each domain controller and update AD, and finally for that value to replicate back to the PDCE. Use the following command to see progress:
Dfsrmig /getmigrationstate

When all DCs are ready, the output will look like this:

7. Migrate to Eliminated State - Finally, you will migrate to the Eliminated state, where DFSR is replicating SYSVOL and FRS is removed. Unlike the Prepared and Redirected states, there is no way to go backwards from this step - once executed, FRS is permanently stopped and cannot be configured again. On the PDC Emulator domain controller, run (as an elevated domain admin):
Dfsrmig /setglobalstate 3

Now you wait for this AD value on the PDCE to converge on all domain controllers, then for DFSR to switch to Eliminated state on each domain controller and update AD, and finally for that value to replicate back to the PDCE. Use the following command to see progress:
Dfsrmig /getmigrationstate

When all DCs are ready, the output will look like this:

Your migration is complete.

Express Migration


In this case, the health of AD and SYSVOL on all domain controllers is known to be healthy. For instance, you are using System Center Operations Manager to monitor your domain controllers and ensure that AD replication, SYSVOL availability, and free disk space are all nominal.

The goal of the Express Migration scenario is to migrate SYSVOL to DFSR with the ability to roll back during the process.

1. Ensure correct security policy - You must ensure that the built-in Administrators group has the “Manage Auditing and Security Log” user right on all your domain controllers. This is on by default, so if it’s not set, someone yanked it. Microsoft does not support removing that, no matter what you may have read elsewhere. To validate, examine the group policy applied to your domain controllers by using Gpresult.exe . For more info, examine KB2567421 .

2. Migrate to Prepared State - Now you will migrate to the Prepared state, where both FRS and DFSR are replicating their own individual copies of SYSVOL, but the FRS copy mounts the SYSVOL and Netlogon shares. On the PDC Emulator domain controller, run (as an elevated domain admin):
Dfsrmig /setglobalstate 1

Now you wait for this AD value on the PDCE to converge on all domain controllers, then for DFSR to switch to Prepared state on each domain controller and update AD, and finally for that value to replicate back to the PDCE. Use the following command to see progress:
Dfsrmig /getmigrationstate

When all DCs are ready, the output will look like this:

As I mentioned in the advice section, you can speed this processing up with faster AD replication and polling.

3. Migrate to Redirected State - Now you will migrate to the Redirected state, where both FRS and DFSR are replicating their own individual copies of SYSVOL, but the DFSR copy mounts the SYSVOL and Netlogon shares. On the PDC Emulator domain controller, run (as an elevated domain admin):
Dfsrmig /setglobalstate 2

Now you wait for this AD value on the PDCE to converge on all domain controllers, then for DFSR to switch to Redirected state on each domain controller and update AD, and finally for that value to replicate back to the PDCE. Use the following command to see progress:
Dfsrmig /getmigrationstate

When all DCs are ready, the output will look like this:

4. Migrate to Eliminated State - Finally, you will migrate to the Eliminated state, where DFSR is replicating SYSVOL and FRS is removed. Unlike the Prepared and Redirected states, there is no way to go backwards from this step - once executed, FRS is permanently stopped and cannot be configured again. On the PDC Emulator domain controller, run (as an elevated domain admin):
Dfsrmig /setglobalstate 3

Now you wait for this AD value on the PDCE to converge on all domain controllers, then for DFSR to switch to Eliminated state on each domain controller and update AD, and finally for that value to replicate back to the PDCE. Use the following command to see progress:
Dfsrmig /getmigrationstate

When all DCs are ready, the output will look like this:

Your migration is complete.

Hyper Migration


In this case, the health of AD and SYSVOL on all domain controllers is known to be healthy. For instance, you are using System Center Operations Manager to monitor your domain controllers and ensure that AD replication, SYSVOL availability, and free disk space are all nominal.

The goal of the Hyper Migration scenario is to migrate SYSVOL to DFSR with the fewest steps and no ability to roll back the migration process once commenced.

1 . Ensure correct security policy - You must ensure that the built-in Administrators group has the “Manage Auditing and Security Log” user right on all your domain controllers. This is on by default, so if it’s not set, someone yanked it. Microsoft does not support removing that, no matter what you may have read elsewhere. To validate, examine the group policy applied to your domain controllers using Gpresult.exe . For more info, examine KB2567421 .

2. Migrate to Eliminated State - DFSR does not mandate that you must migrate through each stage at a time. If you wish, you can trigger migrating all the way to the Eliminated state immediately, where DFSR is replicating SYSVOL and FRS is removed. Unlike the incremental Prepared and Redirected states, there is no way to go backwards from this step - once executed, FRS is permanently stopped and cannot be configured again. On the PDC Emulator domain controller, run (as an elevated domain admin):
Dfsrmig /setglobalstate 3


Now you wait for this AD value on the PDCE to converge on all domain controllers, then for DFSR to switch to Eliminated state on each domain controller and update AD, and finally for that value to replicate back to the PDCE. This will happen for the Prepared, Redirected, and Eliminated stages sequentially, with no need to run each command. Use the following command to see progress:
Dfsrmig /getmigrationstate

When all DCs are ready, the output will look like this:

Your migration is complete.

Naturally, anything faster than Hyper Migration requires your own Schwarzschild Wormhole.

Final Notes


Since you are probably new to SYSVOL using DFSR - and maybe DFSR in general - I highly recommend you review these two KB articles:

They cover the scenario where DFSR may pause replication - due to a power failure or hardware problem - and wait for you to manually resume it. This initially leads to group policy not replicating, but more importantly, eventually leads to a quarantined server. With our latest hotfixes and operating systems, Microsoft recommends disabling this pausing behavior and allow DFSR to resume. If using Windows Server 2008 R2 or Windows Server 2012, use KB2846759 to always automatically resume replication (see section “How to disable the Stop Replication functionality in AutoRecovery”). It’s a simple registry entry, and you can deploy it manually or using Group Policy Preferences . Windows Server 2012 R2 and later default to auto-resuming, so there is nothing to do there.

We went from 52 pages down to a handful, and that was with plenty of screenshots and blather. Now you are running DFSR for SYSVOL and prepared for the future of Windows Server.

Until next time,
- Ned “Einstein–Rosen bridge” Pyle
7 Comments
Regular Visitor

Hi Ned,

 

After migrating to prepared state i run propagating test and see below error.

Propagation test failed.JPG

I'd suggest asking a new forums question here rather than replying to blogs.

https://techcommunity.microsoft.com/t5/Windows-Server-for-IT-Pro/bd-p/WindowsServer

 

 

 

New Contributor

This is AWESOME. I had been trying to migrate my DC on my home/office network and couldn't understand why I could join a new server to the domain, but couldn't get it to promote to DC. Very puzzling.

 

This worked like a charm and I've been able to complete my migration! Thanks!

Senior Member

Thanks for this!  That ridiculous 52 page novel was pretty bad.  You summed it up perfectly.

Occasional Visitor

Hi.

 

I'm in big trouble.

 

I only have one 2008 R2 DC on this domain (domain level 2008), and, I am needing to migrate FRS to DFSR as I need to join a 2019 server to the same domain and then demote the old one.
However, I'm stuck at:
"Unable to create DFSR Migration log file. Error 5 The following Domain Controllers are not in sync with Global state ('Prepared'):
Domain Controller (Local Migration State) - DC Type
2008CSERVER ('Start') - Primary DC
Migration has not yet reached a consistent state on all Domain Controllers. State information might be stale due to AD latency."
There's enough free disk, the correct security policy for the built-in admins group is set, the AD Replication Tool shows no errors at all, nothing (not that there are any other DCs to replicate to anyway), and, Dcdiag /e /test:sysvolcheck /test:advertising is successful. (I went through all the steps in this article)


I then did Dfsrmig /setglobalstate 1 but it's been three days now and I still get the error above.
Any thoughts?
A sysvol DFSR folder has already created inside the windows/sysvol folder, shall I just try the nuclear option of Dfsrmig /setglobalstate 3 ?

(I later tried that, and, while I was now able to join my 2019 server to the domain because FRS was eliminated, my "nuclear" option is stuck at the following state: The following Domain Controllers are not in sync with Global state ('Eliminated'):
Domain Controller (Local Migration State) - DC Type
2008CSERVER ('Start') - Writable DC Migration has not yet reached a consistent state on all Domain Controllers. State information might be stale due to AD latency.)


Do I just do /deletenotntfrsmember now? Also, how do I test that this has worked, I mean, on my new DC, I've already transferred all FSMO roles to it and I can access AD and GPMC and so on but the sysvol folder is empty... Can I just manually copy everything from sysvol from the old DC (since there is only one) and then run /deletenotntfrsmember ? (that server is going to be decommissioned anyway)

 

I have a sysvol DFSR folder on the first (old) server now, and it's got all the policies in it, however, nothing replicating over to my new 2019 DC which has a sysvol folder. (it's just empty)
So do I just manually copy stuff into it, or, what do I do?

 

I think this article is missing a step about checking something, as, I checked everything and it was all fine yet I was still stuck. This was all before the 2019 server was promoted to being a DC.

 

I am decommissioning the old DC anyway, and, will have a new secondary 2019 DC that I haven't even set up yet. If I just copy stuff manually into the empty DFSR folder on the current new 2019 server, and then decommission the 2008 r2 one, will it then just work with a new secondary 2019 server?

 

(I've already transferred all the fsmo roles to the new 2019 DC, do I have to transfer them back to the old one so as to be able to fix this?

I checked on the 2019 DC, and, while I have now manually copied files over into the sysvol folder, it is not even shared on the network, if I do a \\2019dcserverhostname, there are no shares that appear at all, which is weird.)

Occasional Visitor

@fgwefgyadfg need to execute at elevated command prompt, run cmd as administrator

New Contributor

I have a single forest tree composed of 1 root and 1 child domain.

Do I have to perform this operation 2 times?

- 1 in the root 

- 1 in the child

 

Or it is enough 1 time..... utilizing 1 enterprise domain account?

 

I'm just asking because I have performed this activity on the Root domain controller and when I run the "dfsrmig /GetMigrationState" on the Child DC's, I get DFRS migration has not yet initialized.

 

So do I have to run that command in any domain of the forest tree?

 

Kind regards

 

AP

 

Kind regards

 

AP