SYSVOL incorrect DFS target

[hugopeeters]

I'm experiencing the exact problem described in KB 905846:
You may receive random SYSVOL or NETLOGON referrals from the DFS server when
a DFS client tries to access scripts and policies that are stored in the
SYSVOL or NETLOGON shared folders on domain controllers. This behavior may
cause a longer than usual logon delay, because you are retrieving SYSVOL data
from a remote site domain controller.

This is supposed to be fixed by SP2.
My domain controller is running Windows Server 2003 R2 SP2.
The issue is quite annoying, because the other DC's are not reachable.

[Meinolf Weber]

Hello hugopeeters,

Please describe your setup, how many dc's in how many sites. Also post an
unedited ipconfig /all from all dc's here.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

[hugopeeters]

We've got about 15 - 20 DC's in about 15 sites.
The fact that the other DC's are not accessible, is because we are
performing a disaster recovery test. On de recovered DC, we created a DR
site. Sites and Services shows the DR DC in the DR site, and the proper
subnets linked to it. All other sites and corresponding DC's are inaccesible
for the DR site (by design).
The problem is that the DR DC is asked for a target by a server trying to
access the SYSVOL share. The DC responds with a DC in a different site.
dsutil /pktinfo shows the three DC's from the other site are returned as
highest priority targets, even though the server requesting the referral is
located in the subnet of the DR site.

[Miles Li [MSFT]]

Hello,

Thank you for posting in the Partner Newsgroups.

From your description, the domain controller in DR site returns the SYSVOL
or NETLOGON referrals to DCs in other sites from the DFS server.

For further investigation, could you please collect these information and
send to me?

- Directory Service MPS report:

Download Microsoft Product Support's Reporting Tools (MPSRPT_DirSvc.EXE)
http://www.microsoft.com/downloads/details.aspx?FamilyID=CEBF3C7C-7CA5-408F-
88B7-F9C79B7306C0&displaylang=en

You can also get more information about how to use it in the same page (the
readme.txt)

- On one client computer that encounters this issue：
1. Gpresult /v >>gpresult.txt
2. dsutil /pktinfo >>dsutil.txt
3. Are that three DCs returned as highest priority from the other site
always listed by a definite order?

- Network Monitor trace on the DC that clients logon to:

Download the NetMon3.1 from the following link:
http://www.microsoft.com/downloads/details.aspx?FamilyID=18b1d59d-f4d8-4213-
8d17-2f6dde7d7aac&DisplayLang=en

1. Run "dfsutil /PurgeMupCache" and "dfsutil /PktFlush" to clear cache on
the client.
2. Start capture and try to access "\\<domain_name>\sysvol\" in the
Explorer.
3. Stop capture and save to *.cap file.

Please send files and logs to tf...@microsoft.com

Note:

a. Please include the following three lines for this issue in the email
body:

SYSVOL incorrect DFS target
Newsgroup #41831971
Miles Li - MSFT

b. We will continue to discuss the issue here in the newsgroup and will NOT
reply via emails.

c. Pease post a quick note in the current thread to inform me after sending
the email.

Thanks.

Sincerely,
Miles Li

Microsoft Online Partner Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================

[hugopeeters]

I've solved the issue myself, by removing the unreachable DC's from active
directory (metadata cleanup). In a real disaster scenario, this should also
be done.
Using dfsutil /purgemupcache on the affected servers and then browsing to
\\domain\sysvol\ works. dfsutil /pktinfo then shows the correct DFS target
and refreshing group policy no longer results in any error messages (where
before I got event ID 1030 and 1053).

Thanks for your time.

"Miles Li [MSFT]" wrote:

> Hello,
>
> Thank you for posting in the Partner Newsgroups.
>
> From your description, the domain controller in DR site returns the SYSVOL
> or NETLOGON referrals to DCs in other sites from the DFS server.
>
> For further investigation, could you please collect these information and
> send to me?
>
>
> - Directory Service MPS report:
>
> Download Microsoft Product Support's Reporting Tools (MPSRPT_DirSvc.EXE)
> http://www.microsoft.com/downloads/details.aspx?FamilyID=CEBF3C7C-7CA5-408F-
> 88B7-F9C79B7306C0&displaylang=en
>
> You can also get more information about how to use it in the same page (the
> readme.txt)
>

> - On one client computer that encounters this issue£º