SYSVOL : réplication et structure¶

# Read and decode GPT.INI version numbers for all GPOs in the domain
# Returns a table with GUID, raw version, and decoded machine/user counters

$sysvolPolicies = "\\$env:USERDNSDOMAIN\SYSVOL\$env:USERDNSDOMAIN\Policies"

Get-ChildItem $sysvolPolicies -Filter "GPT.INI" -Recurse | ForEach-Object {
    $content   = Get-Content $_.FullName
    $rawLine   = $content | Where-Object { $_ -match "^Version=" }
    $version   = [int]($rawLine -replace "Version=", "")
    $guid      = $_.DirectoryName | Split-Path -Leaf

    [PSCustomObject]@{
        GUID           = $guid
        RawVersion     = $version
        MachineVersion = $version -band 0xFFFF
        UserVersion    = ($version -shr 16) -band 0xFFFF
    }
} | Sort-Object GUID | Format-Table -AutoSize

# Expected output:
# GUID                                   RawVersion  MachineVersion  UserVersion
# ----                                   ----------  --------------  -----------
# {31B2F340-016D-11D2-945F-00C04FB984F9}     196608               0            3
# {6AC1786C-016F-11D2-945F-00C04fB984F9}      65537               1            1
# {A1B2C3D4-...}                              131073               1            2

# Cross-check GPT.INI version against AD GPC versionNumber
# Identifies GPOs where SYSVOL and AD are out of sync

Import-Module GroupPolicy
Import-Module ActiveDirectory

$domain       = $env:USERDNSDOMAIN
$sysvolBase   = "\\$domain\SYSVOL\$domain\Policies"
$gpoPoliciesOU = "CN=Policies,CN=System," + (Get-ADDomain).DistinguishedName

Get-ADObject -SearchBase $gpoPoliciesOU -Filter { ObjectClass -eq "groupPolicyContainer" } `
    -Properties DisplayName, versionNumber, Name | ForEach-Object {

    $guid       = $_.Name
    $adVersion  = $_.versionNumber
    $gptPath    = "$sysvolBase\$guid\GPT.INI"

    $gptVersion = $null
    if (Test-Path $gptPath) {
        $line       = Get-Content $gptPath | Where-Object { $_ -match "^Version=" }
        $gptVersion = [int]($line -replace "Version=", "")
    }

    [PSCustomObject]@{
        GPO         = $_.DisplayName
        GUID        = $guid
        AD_Version  = $adVersion
        GPT_Version = $gptVersion
        InSync      = ($adVersion -eq $gptVersion)
    }
} | Where-Object { -not $_.InSync } | Format-Table -AutoSize

# Expected output (if all in sync, no rows):
# GPO                  GUID          AD_Version  GPT_Version  InSync
# ---                  ----          ----------  -----------  ------
# Firewall - Servers   {A1B2C3...}        65538        65537   False

# Step 1: Check current global migration state across all DCs
# Run from PDC Emulator or any DC with RSAT

Get-ADDomainController -Filter * | ForEach-Object {
    $dc = $_.HostName
    $result = Invoke-Command -ComputerName $dc -ScriptBlock {
        (Get-WmiObject -Namespace "root\MicrosoftDFS" `
            -Class "DfsrMachineConfig" `
            -ErrorAction SilentlyContinue).SysvolReady
    } -ErrorAction SilentlyContinue

    [PSCustomObject]@{
        DC          = $dc
        SysvolReady = $result
        Site        = $_.Site
    }
} | Format-Table -AutoSize

# Expected output:
# DC               SysvolReady  Site
# --               -----------  ----
# dc01.contoso.com        True  Default-First-Site-Name
# dc02.contoso.com        True  Paris
# dc03.contoso.com        True  Lyon

# Step 2: Get global migration state (run on PDC Emulator)
dfsrmig /getmigrationstate

# Expected output when all DCs are at ELIMINATED (state 3):
# All Domain Controllers have migrated successfully to Global state
# ('Eliminated'). SYSVOL is now replicated by DFS Replication.
#
# Migration has reached a consistent state on all Domain Controllers.
# Succeeded.

# Advance migration to PREPARED state — both FRS and DFS-R active
dfsrmig /setglobalstate 1

# Advance to REDIRECTED — DFS-R becomes authoritative
dfsrmig /setglobalstate 2

# Advance to ELIMINATED — FRS stopped permanently
dfsrmig /setglobalstate 3

# Verify DFS-R replication group exists for SYSVOL
# This command should return results on a properly migrated domain

Get-WmiObject -Namespace "root\MicrosoftDFS" -Class "DfsrReplicationGroupConfig" |
    Where-Object { $_.ReplicationGroupName -eq "Domain System Volume" } |
    Select-Object ReplicationGroupName, ReplicationGroupGuid |
    Format-Table -AutoSize

# Expected output:
# ReplicationGroupName  ReplicationGroupGuid
# --------------------  --------------------
# Domain System Volume  {A1B2C3D4-E5F6-...}

# Check SYSVOL share accessibility on all domain controllers
# A False result indicates the DC cannot serve GPOs to clients

Get-ADDomainController -Filter * | ForEach-Object {
    $dc        = $_.HostName
    $sysvol    = Test-Path "\\$dc\SYSVOL" -ErrorAction SilentlyContinue
    $netlogon  = Test-Path "\\$dc\NETLOGON" -ErrorAction SilentlyContinue

    [PSCustomObject]@{
        DC              = $dc
        Site            = $_.Site
        SYSVOL          = $sysvol
        NETLOGON        = $netlogon
    }
} | Sort-Object DC | Format-Table -AutoSize

# Expected output (healthy domain):
# DC               Site                    SYSVOL  NETLOGON
# --               ----                    ------  --------
# dc01.contoso.com Default-First-Site-Name   True      True
# dc02.contoso.com Paris                     True      True
# dc03.contoso.com Lyon                      True      True

# Check DFS-R replication backlog between two DCs
# Replace DC01 and DC02 with actual hostnames

$rgName = "Domain System Volume"
$rfName = "SYSVOL Share"
$sender = "DC01"
$receiver = "DC02"

dfsrdiag backlog /RGName:"$rgName" /RFName:"$rfName" `
    /SendingMember:$sender /ReceivingMember:$receiver

# Expected output (healthy — no backlog):
# No backlog — member is up to date.

# Expected output (backlog present):
# 5 file(s) in backlog from DC01 to DC02.
# <list of pending files>

# Find GPOs with inaccessible GPT.INI in SYSVOL
# A missing GPT.INI means clients cannot process the GPO

Get-GPO -All | ForEach-Object {
    $guid = $_.Id.ToString().ToUpper()
    $path = "\\$env:USERDNSDOMAIN\SYSVOL\$env:USERDNSDOMAIN\Policies\{$guid}\GPT.INI"

    [PSCustomObject]@{
        GPO           = $_.DisplayName
        GUID          = "{$guid}"
        GPTAccessible = (Test-Path $path -ErrorAction SilentlyContinue)
    }
} | Where-Object { -not $_.GPTAccessible } | Format-Table -AutoSize

# Expected output (healthy — no rows):
# (empty — all GPOs have accessible GPT.INI)

# Expected output (problem detected):
# GPO                   GUID                                   GPTAccessible
# ---                   ----                                   -------------
# Security - Workstations {A1B2C3D4-E5F6-7890-ABCD-EF1234567890}         False

# Force DFS-R to poll for changes immediately on a specific DC
# Run locally on the DC that needs to catch up, or via Invoke-Command

Invoke-Command -ComputerName DC02 -ScriptBlock {
    # Restart DFS-R service to force re-initialization (disruptive but effective)
    # Use only if dfsrdiag does not resolve the issue
    # Restart-Service DFSR -Force

    # Preferred: trigger a manual poll without restarting
    $dfsrWmi = Get-WmiObject -Namespace "root\MicrosoftDFS" `
        -Class "DfsrReplicatedFolderConfig" |
        Where-Object { $_.ReplicatedFolderName -eq "SYSVOL Share" }

    if ($dfsrWmi) {
        Write-Output "DFS-R replicated folder found: $($dfsrWmi.ReplicatedFolderName)"
        Write-Output "Current state: check Event ID 5014 after replication completes"
    }
}

# Check NTFS ACL on the SYSVOL Policies folder
# Verify that Authenticated Users has Read & Execute

$sysvolPolicies = "\\$env:USERDNSDOMAIN\SYSVOL\$env:USERDNSDOMAIN\Policies"

(Get-Acl $sysvolPolicies).Access |
    Select-Object IdentityReference, FileSystemRights, AccessControlType, IsInherited |
    Format-Table -AutoSize

# Expected output (healthy):
# IdentityReference                    FileSystemRights  AccessControlType  IsInherited
# -----------------                    ----------------  -----------------  -----------
# NT AUTHORITY\Authenticated Users     ReadAndExecute...          Allow        False
# BUILTIN\Administrators               FullControl                Allow        False
# NT AUTHORITY\SYSTEM                  FullControl                Allow        False
# CONTOSO\Domain Admins                FullControl                Allow        False
# CONTOSO\Enterprise Admins            FullControl                Allow        False
# CREATOR OWNER                        FullControl                Allow        False

# Check ACL on a specific GPO folder in SYSVOL
# Replace the GUID with the target GPO's GUID

$gpoGuid  = "{31B2F340-016D-11D2-945F-00C04FB984F9}"  # Default Domain Policy
$gpoPath  = "\\$env:USERDNSDOMAIN\SYSVOL\$env:USERDNSDOMAIN\Policies\$gpoGuid"

(Get-Acl $gpoPath).Access |
    Select-Object IdentityReference, FileSystemRights, AccessControlType |
    Format-Table -AutoSize

# Expected output:
# IdentityReference                  FileSystemRights  AccessControlType
# -----------------                  ----------------  -----------------
# NT AUTHORITY\Authenticated Users   ReadAndExecute...          Allow
# NT AUTHORITY\SYSTEM                FullControl                Allow
# CONTOSO\Domain Admins              FullControl                Allow

# Reset SYSVOL permissions to defaults on the local DC
# WARNING: This modifies NTFS ACLs — test in a non-production environment first

$sysvolRoot = "$env:SystemRoot\SYSVOL\sysvol\$env:USERDNSDOMAIN"

# Use icacls to reset inheritance and apply default permissions
# This is a simplified example — adapt to your specific ACL requirements
icacls "$sysvolRoot\Policies" /reset /T /C /Q

# Then re-apply base permissions manually or via Group Policy Security templates
Write-Output "ACL reset complete. Verify with (Get-Acl).Access after propagation."

# Expected output:
# processed file: \\...\Policies
# Successfully processed 1 files; Failed processing 0 files
# ACL reset complete. Verify with (Get-Acl).Access after propagation.

# Detect orphaned GPTs: SYSVOL folders with no matching AD GPC object
# Safe to run — read-only, no changes made

$domain      = $env:USERDNSDOMAIN
$sysvolBase  = "\\$domain\SYSVOL\$domain\Policies"
$gpoPoliciesOU = "CN=Policies,CN=System," + (Get-ADDomain).DistinguishedName

# Collect all GPT GUIDs from SYSVOL (folders starting with {)
$sysvolGPTs = Get-ChildItem $sysvolBase -Directory |
    Where-Object { $_.Name -match '^\{[0-9A-Fa-f\-]+\}$' } |
    Select-Object -ExpandProperty Name

# Collect all GPC GUIDs from Active Directory
$adGPOGuids = Get-ADObject -SearchBase $gpoPoliciesOU `
    -Filter { ObjectClass -eq "groupPolicyContainer" } |
    Select-Object -ExpandProperty Name

# Find GUIDs in SYSVOL with no AD counterpart
$orphans = $sysvolGPTs | Where-Object { $_ -notin $adGPOGuids }

if ($orphans.Count -eq 0) {
    Write-Output "No orphaned GPTs found."
} else {
    $orphans | ForEach-Object {
        [PSCustomObject]@{
            OrphanedGPT = $_
            Path        = "$sysvolBase\$_"
        }
    } | Format-Table -AutoSize
}

# Expected output (healthy):
# No orphaned GPTs found.

# Expected output (orphans detected):
# OrphanedGPT                            Path
# -----------                            ----
# {A1B2C3D4-E5F6-7890-ABCD-EF1234567890} \\contoso.local\SYSVOL\...\{A1B2C...}

# Detect orphaned GPCs: AD objects with no matching SYSVOL folder
# These will cause Event ID 1058 on clients

$domain      = $env:USERDNSDOMAIN
$sysvolBase  = "\\$domain\SYSVOL\$domain\Policies"
$gpoPoliciesOU = "CN=Policies,CN=System," + (Get-ADDomain).DistinguishedName

$sysvolGPTs = Get-ChildItem $sysvolBase -Directory |
    Where-Object { $_.Name -match '^\{' } |
    Select-Object -ExpandProperty Name

Get-ADObject -SearchBase $gpoPoliciesOU `
    -Filter { ObjectClass -eq "groupPolicyContainer" } `
    -Properties DisplayName, Name | ForEach-Object {

    $gptExists = $_.Name -in $sysvolGPTs

    if (-not $gptExists) {
        [PSCustomObject]@{
            GPO          = $_.DisplayName
            GUID         = $_.Name
            MissingInSYSVOL = $true
        }
    }
} | Format-Table -AutoSize

# Expected output (healthy — no rows):
# (empty)

# Identify the current PDC Emulator and test connectivity
$pdcEmulator = (Get-ADDomain).PDCEmulator

Write-Output "PDC Emulator: $pdcEmulator"
Test-Connection -ComputerName $pdcEmulator -Count 2 | Select-Object Address, ResponseTime, StatusCode

# Verify SYSVOL share on PDC Emulator specifically
Test-Path "\\$pdcEmulator\SYSVOL"

# Expected output:
# PDC Emulator: dc01.contoso.com
#
# Address          ResponseTime  StatusCode
# -------          ------------  ----------
# dc01.contoso.com           1      Success
# dc01.contoso.com           1      Success
#
# True

# Mark the local DC as authoritative for SYSVOL (DFS-R authoritative restore)
# Run on the DC that will be the authoritative source
# WARNING: All other DCs will overwrite their SYSVOL from this DC

# Step 1: Stop DFS-R service
Stop-Service DFSR

# Step 2: Set the authoritative restore flag in the registry
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Services\DFSR\Parameters\SysVols\Seeding SysVols\<DOMAIN_GUID>"
# Replace <DOMAIN_GUID> with actual domain GUID from:
# (Get-ADDomain).ObjectGUID
Set-ItemProperty -Path $regPath -Name "Enable" -Value 1 -Type DWord

# Step 3: Start DFS-R — it will replicate SYSVOL out to all partners
Start-Service DFSR

Write-Output "DC marked as authoritative. Monitor Event ID 5014 for completion."

# Expected output:
# DC marked as authoritative. Monitor Event ID 5014 for completion.

# Check SysvolReady registry value on all domain controllers
# A value of 0 means the DC is not advertising SYSVOL to clients

Get-ADDomainController -Filter * | ForEach-Object {
    $dc = $_.HostName
    $ready = Invoke-Command -ComputerName $dc -ScriptBlock {
        (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" `
            -Name "SysvolReady" -ErrorAction SilentlyContinue).SysvolReady
    } -ErrorAction SilentlyContinue

    [PSCustomObject]@{
        DC          = $dc
        SysvolReady = $ready
        Status      = if ($ready -eq 1) { "OK" } else { "NOT READY" }
    }
} | Format-Table -AutoSize

# Expected output (healthy):
# DC               SysvolReady  Status
# --               -----------  ------
# dc01.contoso.com           1  OK
# dc02.contoso.com           1  OK
# dc03.contoso.com           1  OK