I’m helping with an inherited domain where replication between the existing domain controllers is failing. One controller also hosts on-prem Exchange, and a newly promoted controller is stuck initializing SYSVOL with DFSR. Mailboxes have been moved to cloud-only accounts. What would you check before demoting or rebuilding anything, especially around SYSVOL and Exchange cleanup?
How would you tackle broken AD replication with Exchange on a DC?
Asked by
q6-Whiffet
Answers
Pause before removing controllers. First establish which DC has healthy, current directory data and whether it holds any FSMO roles. Check replication status and errors, DNS records and client settings, time synchronization, network connectivity, and the DFS Replication logs. Also confirm whether SYSVOL and NETLOGON are shared on the surviving controller.
For the DFSR initialization error, diagnose the existing SYSVOL state before applying an authoritative or non-authoritative recovery procedure. Those choices depend on which copy is known-good. Don’t promote another DC until the current replication and SYSVOL issues are understood.
Reply to this answer
Check DNS and stale metadata carefully. Look for records, server objects, or connection references belonging to old or partly demoted controllers, and confirm each DC uses valid internal DNS resolvers. Also check that the clocks agree and that the machines can reach each other over the required network paths.
Once you know the current DC is healthy, remove failed controllers using the appropriate demotion or metadata-cleanup process, then clean up their DNS and site entries. Rebuilding first without finding the cause can just reproduce the same failure.
Reply to this answer
Be especially cautious with the Exchange machine. Moving mailboxes to cloud-only accounts does not by itself prove Exchange has been cleanly removed from the environment or that all directory references are disposable. Verify the Exchange version and state, whether it is still needed for recipient management or other dependencies, and follow the supported removal guidance for that specific setup.
I would not improvise an Exchange cleanup while the directory is unhealthy. Get the AD replication and SYSVOL situation stable, take recoverable backups, and plan the Exchange removal separately.
e7+Furling:
So the mailbox move and Exchange server removal should be treated as separate tasks, not assumed to be the same thing.
Reply to this answer
Keep the recovery plan reversible. Take and verify system-state backups, document FSMO roles and DNS configuration, and make sure you have a known-good recovery path before demoting anything. If only one DC remains, confirm it has working DNS, SYSVOL, and directory services before introducing a replacement.
For a very small organization, a fresh domain might be considered, but that is a migration with its own account, device, permissions, and application consequences. Don’t treat it as a shortcut until the scope and dependencies are known.
Reply to this answer
Add your answer
Answers are reviewed before publication.
q6-Whiffet:
That makes sense. I’ll verify which SYSVOL copy is reliable before trying a recovery procedure.