DFS replication issues

nikitamobile855 

If you can't see it then the error doesn't make any sense, either.

Rather than trying to work through checking each object individually, I've written a quick script (inserted at the bottom of this post) to pull some of the DFS (-N and -R) configuration information from Active Directory.

If you can save it as "Get-DfsConfiguration.ps1", then run it as shown below and upload the JSON, that would help with the cross-referencing.

You can direct-message me the results if you'd prefer not to post them here, but there's nothing confidential about it, meaning others here may be able to offer insight if you choose to paste the results in here.

.\Get-DfsConfiguration.ps1 | ConvertTo-Json -Depth 3

If the script throws an error, let me know and I'll fix it as I didn't spend much time quality assuring it. But if it behaves, the output will help with both of your TechCommunity threads.

It does not need any special rights and can (and should) be run as a normal, unprivileged user.

Also, can you check that the DFS service is running on your domain controller? (i.e. "Get-Service -Name Dfs")

Cheers,

Lain

[cmdletbinding()]
Param()

#region Class definitions.
class DfsrSubscriber
{
    [string] $Status;
    [guid] $ObjectGUID;
    [string] $ObjectClass;
    [string] $Name;
    [string] $DistinguishedName;
    [string] $MemberReference;

    DfsrSubscriber([guid] $ObjectGUID, [string] $Name, [string] $DistinguishedName, [System.DirectoryServices.PropertyValueCollection] $MemberReference)
    {
        $this.ObjectGUID = $ObjectGUID;
        $this.ObjectClass = "msDFSR-Subscriber";
        $this.Name = $Name;
        $this.DistinguishedName = $DistinguishedName;
        if (($MemberReference.Count -gt 0) -and ([adsi]::Exists("$($Script:AdsPrefix)/CN=SYSVOL Subscription,$DistinguishedName")))
        {
            $this.Status = "Okay";
            $this.MemberReference = $MemberReference[0];
        }
        else
        {
            $this.Status = "Unhealthy";
            $this.MemberReference = $null;
        }
    }
}

class DfsrSubscription
{
    [string] $Status;
    [guid] $ObjectGUID;
    [string] $ObjectClass;
    [string] $Name;
    [string] $DistinguishedName;

    DfsrSubscription([guid] $ObjectGUID, [string] $Name, [string] $DistinguishedName)
    {
        $this.Status = "Okay";
        $this.ObjectGUID = $ObjectGUID;
        $this.ObjectClass = "msDFSR-Subscription";
        $this.Name = $Name;
        $this.DistinguishedName = $DistinguishedName;
    }
}

class DfsrReplicationGroup
{
    [string] $Status;
    [guid] $ObjectGUID;
    [string] $ObjectClass;
    [string] $Name;
    [string] $DistinguishedName;

    DfsrReplicationGroup([guid] $ObjectGUID, [string] $Name, [string] $DistinguishedName)
    {
        $this.ObjectGUID = $ObjectGUID;
        $this.ObjectClass = "msDFSR-ReplicationGroup";
        $this.Name = $Name;
        $this.DistinguishedName = $DistinguishedName;
        
        if ([adsi]::Exists("$($Script:AdsPrefix)/CN=Topology,$DistinguishedName"))
        {
            $this.Status = "Okay";
        }
        else
        {
            $this.Status = "Unhealthy";
        }
    }
}

class DfsrMember
{
    [string] $Status;
    [guid] $ObjectGUID;
    [string] $ObjectClass;
    [string] $Name;
    [string] $DistinguishedName;
    [string] $ComputerReference;
    [string] $ServerReference;
    [string] $MembershipBL;

    DfsrMember([guid] $ObjectGUID, [string] $Name, [string] $DistinguishedName, [System.DirectoryServices.PropertyValueCollection] $ComputerReference, [System.DirectoryServices.PropertyValueCollection] $ServerReference, [System.DirectoryServices.PropertyValueCollection] $MembershipBL)
    {
        $this.ObjectGUID = $ObjectGUID;
        $this.ObjectClass = "msDFSR-Member";
        $this.Name = $Name;
        $this.DistinguishedName = $DistinguishedName;
        $this.Status = "Okay";
        $this.MembershipBL = $MembershipBL;
        
        #region Validate ComputerReference.
        if ($ComputerReference.Count -gt 0)
        {
            $this.ComputerReference = $ComputerReference[0];
        }
        else
        {
            $this.Status = "Unhealthy";
            $this.ComputerReference = $null;
        }
        #endregion
        
        #region Validate ServerReference.
        if ($ServerReference.Count -gt 0)
        {
            $this.ServerReference = $ServerReference[0];
        }
        else
        {
            $this.Status = "Unhealthy";
            $this.ServerReference = $null;
        }
        #endregion
        
        #region Validate MembershipBL.
        if ($MembershipBL.Count -gt 0)
        {
            $this.MembershipBL = $MembershipBL[0];
        }
        else
        {
            $this.Status = "Unhealthy";
            $this.MembershipBL = $null;
        }
        #endregion
    }
}

class DfsNamespaceV2
{
    [string] $Status;
    [guid] $ObjectGUID;
    [string] $ObjectClass;
    [string] $Name;
    [string] $DistinguishedName;
    [System.Collections.Generic.List[DfsNamespaceV2Target]] $Targets;

    DfsNamespaceV2([guid] $ObjectGUID, [string] $Name, [string] $DistinguishedName, [System.DirectoryServices.PropertyValueCollection] $Targets)
    {
        $this.ObjectGUID = $ObjectGUID;
        $this.ObjectClass = "msDFS-Namespacev2";
        $this.Name = $Name;
        $this.DistinguishedName = $DistinguishedName;
        $this.Targets = Get-DfsV2Target -TargetListV2 $Targets;

        if ($this.Targets.Count -gt 0)
        {
            $this.Status = "Okay";
        }
        else
        {
            $this.Status = "Unhealthy";
        }
    }
}

class DfsNamespaceV2Target
{
    [bool] $Online;
    [string] $Target;

    DfsNamespaceV2Target([string] $Status, [string] $Target)
    {
        $this.Online = $Status -eq "online";
        $this.Target = $Target;
    }
}
#endregion

#region Function definitions.
function Get-DfsV2Target([System.DirectoryServices.PropertyValueCollection] $TargetListV2)
{
    $Targets = [System.Collections.Generic.List[DfsNamespaceV2Target]]::new();

    if ($TargetListV2.Count -gt 0)
    {
        $Xml = [xml]::new();
        $Xml.LoadXml(([System.Text.Encoding]::Unicode.GetString($TargetListV2[0])).SubString(1));

        foreach ($Entry in $Xml.DocumentElement.target)
        {
            $Targets.Add([DfsNamespaceV2Target]::new($Entry.state, $Entry.InnerText));
        }
    }

    return($Targets);
}
#endregion


#region Preamble.
$RootDSE = [adsi]"LDAP://RootDSE";
$Server = $RootDSe.dNSHostName[0].ToLowerInvariant();
$DefaultNamingContext = $RootDSE.defaultNamingContext[0];
$AdsPrefix = "LDAP://$Server";

Write-Verbose "Connected to domain controller: $Server";
Write-Verbose "Default naming context: $DefaultNamingContext";
#endregion

#region Enumerate domain controllers for SYSVOL DFS-R memberships. These represent the forward references pointing to the replication groups.
Write-Warning "Enumerating domain controller SYSVOL DFS-R memberships:";
$SysvolTopology = [adsi]"$AdsPrefix/OU=Domain Controllers,$DefaultNamingContext";
foreach ($DomainController in $SysvolTopology.Children)
{
    if (-not [adsi]::Exists("$AdsPrefix/CN=DFSR-LocalSettings,$($DomainController.distinguishedName)"))
    {
        continue;
    }

    foreach ($DfsrSubscriber in $DomainController.Children.Find("CN=DFSR-LocalSettings").Children)
    {
        $DfsrSubscriberSummary = [DfsrSubscriber]::new($DfsrSubscriber.objectGUID[0], $DfsrSubscriber.Name[0], $DfsrSubscriber.distinguishedName[0], $DfsrSubscriber.Properties['msDFSR-MemberReference']);
        $DfsrSubscriberSummary;
        
        if ($DfsrSubscriberSummary.Status.Equals("Okay", [System.StringComparison]::Ordinal))
        {
            foreach ($DfsrSubscription in $DfsrSubscriber.Children)
            {
                # Arguably, this could be left out as it currently doesn't add much to the SYSVOL discussion. Only red flag would be if it were missing (given the subscriber implicitly exists.)
                [DfsrSubscription]::new($DfsrSubscription.objectGUID[0], $DfsrSubscription.Name[0], $DfsrSubscription.distinguishedName[0]);
            }
        }
    }
}
$SysvolTopology.Dispose();
#endregion

#region Enumerate DFS-R replication groups. These contain the topology definitions, which in turn contain back-link references to the server objects' membership definitions.
Write-Warning "Enumerating DFS-R replication group topologies:";
$DfsrGroups = [adsi]"$AdsPrefix/CN=DFSR-GlobalSettings,CN=System,$DefaultNamingContext";
foreach ($DfsrGroup in $DfsrGroups.Children)
{
    $DfsrGroupSummary = [DfsrReplicationGroup]::new($DfsrGroup.objectGUID[0], $DfsrGroup.Name[0], $DfsrGroup.distinguishedName[0]);
    $DfsrGroupSummary;

    if ($DfsrGroupSummary.Status.Equals("Okay", [System.StringComparison]::Ordinal))
    {
        foreach ($DfsrMember in $DfsrGroup.Children.Find("CN=Topology").Children)
        {
            [DfsrMember]::new($DfsrMember.objectGUID[0], $DfsrMember.Name[0], $DfsrMember.distinguishedName[0], $DfsrMember.'msDFSR-ComputerReference', $DfsrMember.serverReference, $DfsrMember.'msDFSR-MemberReferenceBL');
        }
    }
}
$DfsrGroups.Dispose();
#endregion

#region Enumerate DFS-N namespaces. Note: SYSVOL isn't defined here as that's handled differently.
Write-Warning "Enumerating DFS-N namespaces:";
$DfsNamespaces = [adsi]"$AdsPrefix/CN=Dfs-Configuration,CN=System,$DefaultNamingContext";
foreach ($DfsNamespaceAnchor in $DfsNamespaces.Children)
{
    if ($DfsNamespaceAnchor.Children.Count -eq 0)
    {
        continue;
    }
    
    foreach ($DfsNamespace in $DfsNamespaceAnchor.Children)
    {
        [DfsNamespaceV2]::new($DfsNamespace.objectGUID[0], $DfsNamespace.Name[0], $DfsNamespace.distinguishedName[0], $DfsNamespace.'msDFS-TargetListv2');
    }
}
$DfsNamespaces.Dispose();
#endregion

$RootDSE.Dispose();

Edited: 2022-06-11 to include a serverReference check on msDFSR-Member objects.