The 9 DFS-R States
-
START
(stable state 0) designates the initial point of the migration. At this stage, it is critical to make sure that both Active Directory and FRS-basedSYSVOL
replication function properly. To test the former, use theRepAdmin
command line utility (with/showrepl /all
or/replsum
switches). To verify status of the latter, take advantage of such utilities as FRSDiag, Sonar, or Ultrasound, which is available from the Microsoft Download Center. Make sure that the DFS Replication service is running and configured with Automatic startup on each domain controller. Confirm that the domain operates on the Windows Server 2008 functional level (which implies that all domain controllers are running Windows Server 2008). Verify that all domain controllers function properly and are accessible, paying particular attention to the PDC Emulator (as a matter of fact, you might want to consider running the migration directly from its console). Avoid adding new domain controllers or introducing changes toSYSVOL
for the duration of the migration. If you decide to install a Read Only Domain Controller after the domain reaches thePREPARED
state, you will need to manually create its DFS-R specific Active Directory settings by executingDFSRMig /CreateGlobalObjects
command.
Read More About Windows Server 2008Finally, make sure that every volume containing
SYSVOL
folder on each domain controller has a sufficient amount of disk space (at a minimum, it should be capable of holding its copy). Once you have confirmed that all prerequistes are satisfied, enter thePREPARING
transitional state by executingDFSRMig /SetGlobalState 1
command while logged on with an account that is a member of the Domain Admin (or Enterprise Admin) group. Note that although it is possible to perform the migration by specifying the final value of 3, representing theELIMINATED
state, such approach is not recommended since it does not provide rollback capabilities). -
PREPARING
(transitional state 4) starts with creation of the DFS-R Global Settings objectCN=DFSR-GlobalSettings
(and its child objects) under the System container of the default naming context in Active Directory (the change takes place on the PDC Emulator and propagates afterwards via standard AD replication to other domain controllers). ItsmsDFSR-Flags
attribute is used throughout the migration to serve as an indication of the current global status (its value is derived from themsDFSR-Flags
attribute of theCN=dfsr-LocalSettings
child object of each domain controller computer account (which also gets created when thePREPARING
state starts and is updated throughout the migration to reflect status of individual domain controllers). Other settings (underCN=DFSR-GlobalSettings
) are used to designate replication content and topology ofSYSVOL_DFSR
among all domain controllers. Note that PDC Emulator is also responsible for all necessary objects specific to all Read Only Domain Controllers residing in the same the domain (since such changes can not be applied directly to Active Directory database hosted on each RODC). DFS-R service also createsSYSVOL_DFSR
folder on the same volume as theSYSVOL
and duplicates the content (leveragingrobocopy
utility) of itsdomain
subfolder (including permissions and junction points). This is intended to minimize time and bandwidth required to complete initial DFS-R based replication with other domain controllers (which takes place in theREDIRECTING
state). The current state of migration gets registered using theLocal State
entry ofREG_DWORD
datatype underHKLMSystemCurrentControlSetServicesDFSRParametersSysVolsMigrating SysVols
registry key. -
WAITING FOR INITIAL SYNC
(transitional state 5) follows automatically thePREPARING
state. It is designed to complete configuration of theSYSVOL_DFSR
, including its synchronization with another writable domain controller and setup of the corresponding Jet database. Effectively, once this step successfully completes, there are two separate replication mechanisms, with the FRS handling the originalSYSVOL
and DFS-R synchronizing itsSYSVOL_DFSR
-based duplicate. During its execution, the value ofLocal State
registry entry on each domain controller changes from 4 to 5. -
PREPARED
(stable state 1) is characterized by existence of two independently replicated instances ofSYSVOL
, with FRS as the primary replication engine, handling the content available via theSYSVOL
share and DFS-R managing its non-shared duplicate residing in theSYSVOL_DFSR
folder. In order to confirm whether this stage has been reached (which coincides with the event id 8014 registered in the local DFS Replication Event Log), examine output of theDFSRMig /GetMigrationState
command, which queries migration state information from all domain controllers and displays the outcome, identifying any that have not reached the migration state set on the PDC Emulator. Remember that such discrepancies should be remediated before you proceed further. Note also that it is possible to manually expedite migration process. This can be done by forcing AD replication (to propagate changes to the globalmsDFSR-Flags
attribute) withrepadmin
utility (by leveraging itsreplicate
orSyncAll
switches). It is also possible to force DFS Replication service to discover the newly applied global migration settings by executingDFSRDiag PollAD
with Member attribute pointing to the PDC Emulator. Once you confirm that thePREPARED
state is consistent across the domain, you are ready to proceed to the next step by launching theDFSRMig /SetGlobalState 2
command. -
REDIRECTING
(transitional state 6) starts by synchronizing content of theSYSVOL
and its DFS-R equivalentSYSVOL_DFSR
on the PDC Emulator (which subsequently replicates to other domain controllers). This is done to account for any changes that might have taken place (typically introduced via Group Policy modifications) since thePREPARED
state has been reached. Next, theSysvolReady
entry underHKLMSystemCurrentControlSetServicesNetlogonParameters
registry key is set to0
(translating into booleanFALSE
), which effectively prevents theSYSVOL
from being shared. This action is followed by changing the value ofSYSVOL
share Path parameter toSYSVOL_DFSRsysvol
. Finally,SysvolReady
gets set back to1
(corresponding to the booleanTRUE
), which reinstates theSYSVOL
share (but associated with the new file system location). In addition, the Active Directory Domain Services service is added to the list of dependencies of the DSF Replication service (along with the File Replication service). -
REDIRECTED
(stable state 2) is somewhat similar toPREPARED
, since bothSYSVOL
replication mechanisms are still active, with DFS-R handling replication of theSYSVOL_DFSR
folder and FRS being responsible forSYSVOL
. However, theSYSVOL
share no longer points to the legacy location but instead provides access to theSYSVOL_DFSRsysvol
folder. As the implication of this arrangement, any direct changes to the originalSYSVOL
folder should be avoided, since they will be lost once you perform remaining migration steps (note, however, that this concern does not apply to modifications applied via Group Policy Management Console, which properly points to the new shared location). As before, you can confirm the status of transition by reviewing output generated by theDFSRMig /GetMigrationState
command (successful outcome is also be reflected by an event ID 8017 recorded in the DFS Replication event log on each of domain controllers and the value ofLocal State
registry entry referenced by us earlier). For more in-depth troubleshooting, useDFSRMig_xxx.Log.gz
files residing in theDebug
subfolder underWindows
folder (where xxx is sequentially assigned integer value). This verification is critical, since the next step is non-reversible (the only way to return your domain from theELIMINATED
toSTART
state is the full domain restore). Once you are ready, execute theDFSRMig /SetGlobalState 3
command. -
ELIMINATING
(transitional state 7) eliminates dependency of the Active Directory Domain Services service on the File Replication Service, stops it temporarily and removes all Active Directory-resident settings pertinent to itsSYSVOL
replication characteristics. These changes are relayed to other domain controllers via standard AD replication. It also deletes content of theSYSVOL
folder. Once these changes are completed, the FRS service is restarted again to accommodate scenarios where other content is replicated using this mechanism. -
ELIMINATED
(stable state 3) constitutes the final state of migration. As before, its status can be verified by running theDFSRMig /GetMigrationState
command or checking the value ofLocal State
registry entry on individual domain controllers (as well as the presence of the event 8019 in the DFS Replication event log). In addition, theSysVol
registry entry (underHKLMSystemCurrentControlSetServicesNetlogonParameters
key) should point out theSYSVOL_DFSR
folder (and the value ofSysvolReady
entry in the same location should be set to1
). -
UNDO REDIRECTING
(transitional state 8) facilitates reverting from theREDIRECTED
toPREPARED
state. To invoke it, executeDFSRMig /SetGlobalState 1
. As part of the transition, theSYSVOL_DFSR
folder is first synchronized with itsSYSVOL
counterpart (leveragingrobocopy
utility) to account for any changes to its content that might have taken place while inREDIRECTED
state (typically introduced via Group Policy modifications). This synchronization takes place on the PDC Emulator and is subsequently replicated via FRS-driven replication. -
UNDO PREPARING
(transitional state 9) permits you to return to theSTART
state fromPREPARED
state (with FRS mechanism handlingSYSVOL
replication and theSYSVOL_DFSR
folder removed). To invoke it, useDFSRMig /SetGlobalState 0
command. Note that, similarly to thePREPARING
transitional state, PDC Emulator will be responsible for deleting all DFS-R Active Directory objects specific to Read Only Domain Controllers.
This concludes our overview of characteristics of DFS-R SYSVOL
replication available in Windows Server 2008 functional level domains and an outline of the steps involved in transitioning to it from FRS mechanism employed in earlier implementations of Active Directory. Our next article will focus on new Group Policy features.