Why did the Sysvol and Netlogon folders disappear on one of the domain controllers?

Question

Active Directory

There is an infrastructure with two domain controllers. Domain level Windows
Server 2003.
SERVER - old domain controller on Windows Server 2003
SLC-SWH-DC01 - domain controller on Windows Server 2008
The other day there were small problems with replication - passwords were not replicated.
Dcidag /q and repadmin /showrepl said everything was fine.
Yesterday I found JRNL_WRAP_ERROR errors in the domain controller logs Event ID: 13508 Source: NFrs, well, as expected and indicated www.eventid.net/display-eventid-13568-source-NtFrs...
On the SLC-SWH-DC01 controller, performed the following steps :
--------------------------------
2. Change value for "Enable Journal Wrap Automatic Restore" from 0 to 1. If the DWORD Value does not exist, create a new one with the exact spelling as above, including spaces but without the quotes.
3. Stop the NTFRS Service (open a command prompt and type "net stop ntfrs")
4. Start the NTFRS Service (net start ntfrs)
5. Monitor the File Replication Service Event Logs for events:
• 13553 – The DC is performing the recovery process
• 13554 – The DC is ready to pull the replica from another DC.
• 13516 - At this point go to step 6. (the problem is resolved if you
receive this event)
6. Using a command prompt type: "net share" and look for the Netlogon and
Sysvol Shares to appear. The Journal Wrap error is only fixed after the Domain Controller receives the new SYSVOL replica from a peer Domain Controller. This may take a period of time depending on where your peer DC is located and on bandwidth.
-------------------------------------------------- -----
Waited, waited a long time. As a result, when starting net share SLC-SWH-DC01, SYSVOL and Netlogon disappeared from the list of visible shares. On the SERVER domain controller - they remained visible and are still visible.
I repeated this procedure several times - it did not help.
In the logs of the SLC-SWH-DC01 domain controller, an error appeared Event ID: 13508
Source: NtFrs
as advised here:
www.eventid.net/display-eventid-13508-source-NtFrs...
phase-1.htm did the following on SLC-SWH-DC01:
1. Stop FRS.
2. Start Registry Editor (Regedt32.exe).
3. Locate and click the following key in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore/Process at Startup
4. On the Edit menu, click Add Value, and then add the following registry
value:
Value name: BurFlags
Data type: REG_DWORD
Radix: Hexadecimal
Value data: D2
(I used the D2 parameter to start a non-authoritative restor - since there is nothing else in the local sysvol folder on the "new" domain controller, I wanted to "pull" the policies and sysvol from the old domain controller)
5. Quit Registry Editor.
6. Restart FRS.
It did not help, the Sysvol and Netlogon balls are also not visible on the SLC-SWH-DC01 server.
What we have in the bottom line:
1. Sysvol and Netlogon balls are also not visible on the SLC-SWH-DC01 server
2. Sysvol and Netlogon balls are also visible on the SERVER server
3. if you fill in the \\importlift.local\ path, then the balls are visible ( apparently just "throws")
4. In the logs of the domain controller SLC-SWH-DC01, errors are pouring about the impossibility of applying group policies.
5. Error JRNL_WRAP_ERROR appeared in the logs of the SERVER domain controller Event code: 13508 Source: NFrs (what was originally on the SLC-SWH-DC01 controller) - now I'm afraid to run it too - I'm afraid that it will completely fall.
I ask for help below - there are critical settings (roaming profiles) that are tied to the GPO, but I don’t even know what to do next!
files.mail.ru/ECA81838C22B41A89606941DC6B076FF

Answer 1

Thanks to all. Problem solved.
Step by step solution is described here:
www.doitfixit.com/index.php?option=com_content&vie...