How to Upgrade SYSVOL Replication to DFSR (A Practical, Low-Drama Guide)

Photo by yaroslav-shuraev pexels

Oct 16, 2025

If you’ve inherited a “modern” domain (2016/2019/2022 DCs) but Group Policy changes are flaky or slow, there’s a common culprit: SYSVOL is still replicating with FRS (File Replication Service), which has been deprecated for years. That often happens after in-place OS upgrades where nobody finished the SYSVOL replication upgrade to DFSR.

This guide shows you how to upgrade SYSVOL replication to DFSR cleanly. We outline pre-checks, staged cutover, and quick verification below. It’s written for busy IT leads at Denver-area SMBs who want a safe, predictable process that avoids downtime or policy drift.

Quick Orientation: What and Why

SYSVOL

SYSVOL is a shared folder every domain controller uses for logon scripts and Group Policy.

Default path: %SystemRoot%\SYSVOL.

FRS vs. DFSR

  • FRS = legacy, fragile, noisy.

  • DFSR = modern, efficient, self-healing, better conflict handling.

FSIMO role moves don’t migrate SYSVOL

You can have shiny new DCs and still rely on FRS. The SYSVOL migration is a separate step. This post shows you how to upgrade SYSVOL replication to DFSR the right way.

Before You Start: Prerequisites & Safety Checks

Before you upgrade SYSVOL replication to DFSR, complete these checks to avoid broken GPOs or stalled replication later.

1. Back up and validate replication

Back up your DCs (system state) and export all GPOs:

Backup-Gpo -All -Path "D:\GPO-Backups\Pre-DFSR-$(Get-Date -Format yyyyMMdd)"

Health check AD replication:

repadmin /replsummary

repadmin /showrepl *

dcdiag /c /v

2. Verify functional levels

Your forest and domain functional levels must be Windows Server 2008 or higher (recommend the highest available):

Get-ADForest | Select-Object ForestMode

Get-ADDomain | Select-Object DomainMode

If you’re mixing 2016 and 2019 DCs, setting a 2016 functional level is fine.

3. Confirm your current SYSVOL replication state

Before beginning your SYSVOL replication upgrade to DFSR, confirm whether a migration has already started:

dfsrmig /getglobalstate

If it reports Start (0) → you’re using FRS and safe to proceed.

If Prepared (1), Redirected (2), or Eliminated (3) → a migration was already started. Resume from that phase — do not restart.

Tip: If DCs report inconsistent states, fix AD replication first before proceeding.

4. Validate time sync and DNS

Confirm domain controllers are time-synchronized and DNS is clean. Clock drift and DNS misconfiguration are two of the most common causes of migration failure.

The Four DFSR Migration Phases

  • State 0 – Start
    FRS serves and replicates SYSVOL (business as usual).

  • State 1 – Prepared
    DFSR builds a parallel SYSVOL at %SystemRoot%\SYSVOL_DFSR. It’s not live yet.

  • State 2 – Redirected
    DFSR’s SYSVOL becomes authoritative for clients. FRS still replicates, but it’s no longer serving production.

  • State 3 – Eliminated
    DFSR fully owns SYSVOL replication. Windows removes the old FRS SYSVOL and stops the FRS service.

Migration: Step-by-Step Process

Run these commands on a DC as Domain Admin or Enterprise Admin, waiting for convergence at each step.

1) START

dfsrmig /setglobalstate 1

1. PowerShell command to upgrade SYSVOL replication to DFSR

Type the command below to confirm all domain controllers have reached prepared state

dfsrmig /getmigrationstate 
step 2

2) REDIRECTED STATE

dfsrmig /setglobalstate 2 
3. PowerShell command to upgrade SYSVOL replication to DFSR

Type the command below to confirm all domain controllers have reached redirected state

dfsrmig /getmigrationstate 
4. step 4

3) ELIMINATED STATE

dfsrmig /setglobalstate 3
5. Verifying SYSVOL replication health after upgrade

Type the command below to confirm all domain controllers have reached eliminated state

dfsrmig /getmigrationstate 
6. Verifying SYSVOL replication health after upgrade

And that’s it! With the migration process now complete, go ahead and confirm to confirm the SYSVOL share.  Type net share command and enter.

step 7 confirm

Post-Migration Validation

Lastly, make sure in each domain controller FRS service is stopped and disabled. This should be automatic.

If the services are not disabled, re-check your migration state before manually disabling.

8. Verifying SYSVOL replication health after upgrade

Common Pitfalls to Avoid

  • Half-migrations: If someone started years ago and stopped, pick up at the current state, don’t reset to 0.

  • Replication backlog: Fix AD replication errors before changing states.

  • Low disk space: DFSR needs free space to stage data.

  • Antivirus exclusions: Don’t scan SYSVOL/DFSR paths.

  • Impatience: Wait for “reached the target state” on all DCs before moving forward.

FAQs About the SYSVOL Replication Upgrade

Q: Do I need downtime to upgrade SYSVOL replication to DFSR?
A: Usually not. The change is staged, and cutover happens at Redirected.

Q: Will Group Policy break?
A: Not if AD replication is clean and you wait for convergence at each phase.

Q: Can I roll back?
A: You can revert before Eliminated. After that, rollback means rebuilding SYSVOL manually. Remember backups are your safety net.

Quick Checklist for Your Runbook

☐ Back up GPOs and DC system state

☐ Confirm repadmin / dcdiag are clean

☐ Forest/Domain functional level ≥ 2008

☐ Verify current global state

☐ Set Prepared (1) → converge

☐ Set Redirected (2) → converge

☐ Set Eliminated (3) → converge

☐ Verify SYSVOL share and DFSR health

☐ Confirm FRS stopped and GPO replication working

When to Call for Help

If AD replication isn’t clean, or you’re juggling mixed-mode DCs, bring in an expert. Our engineers have seen every kind of “half-finished migration” out there. We can verify health, remediate replication, and safely upgrade SYSVOL replication to DFSR without breaking production GPOs.

Schedule Your Free Network Snapshot
Book your free (no-obligation) asssessment with us. We’ll flag any SYSVOL, DNS, or replication issues before you begin your migration.

Talk to an Engineer Today