Troubleshooting SYSVOL and DFS Replication Errors on Windows Server

SYSVOL holds every Group Policy Object and logon script in the domain, and it’s replicated between DCs using DFS Replication (DFSR) on any reasonably modern domain. When SYSVOL replication breaks, GPOs stop applying consistently across sites, one of the most common causes of “the policy works on some machines but not others” tickets.

Check DFSR health first

dfsrdiag replicationstate shows current replication activity between DCs, and the DFS Replication event log (Applications and Services Logs > DFS Replication) is the primary source of specific error codes. Event ID 2213 specifically indicates a USN journal wrap. The most serious and common SYSVOL replication failure.

Understanding a journal wrap

A journal wrap happens when the NTFS USN journal DFSR relies on to track changes gets overwritten faster than DFSR can read it, usually caused by an undersized journal on a volume with heavy file activity, or a DC that was offline for an extended period. Once it happens, that DC can no longer reliably replicate SYSVOL until it’s resynced from scratch.

Recovering with a non-authoritative sync

For an affected DC, force it to rebuild its SYSVOL copy from a healthy DC rather than treating its own copy as valid: use Set-ADObject against the DC’s DFSR-LocalSettings SYSVOL subscription object to set msDFSR-Enabled to False, wait for AD replication, then flip it back to True. This tells DFSR on that specific DC to rebuild non-authoritatively from its replication partners rather than treating its potentially corrupted local copy as the source of truth.

Only ever do an authoritative sync as a last resort

If every DC’s SYSVOL is suspect (a genuinely rare and serious scenario), you can designate ONE DC as authoritative and force every other DC to non-authoritatively rebuild from it, but this is a last-resort, whole-domain operation that should only follow official Microsoft guidance, since getting the authoritative DC choice wrong can propagate bad or missing GPO data domain-wide.

For official guidance, see Microsoft’s Windows Server documentation.