sysvol

SYSVOL replication, by SSH

Returns the DFS Replication state of SYSVOL on a domain controller, and the last error DFS Replication noted on it. One watch is proposed, checked: SYSVOL that is not in its normal state.

Versions

A domain controller running Windows Server 2012 or later, with Windows PowerShell 3.0 or later, as the prerequisites name them, and SYSVOL replicated by DFS Replication: a SYSVOL still replicated by FRS stops the collector as misconfigured. Generic: no folder of version. That every release answers alike is assumed, not yet checked on a real domain controller.

How it works

The collector runs one PowerShell command that reads the replicated folders of DFS Replication and keeps the one of the replication group "Domain System Volume", which replicates SYSVOL:

powershell -NoProfile -NonInteractive -Command "$ErrorActionPreference = 'Stop'; [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding; ConvertTo-Json -Compress -Depth 4 -InputObject @{folders = @(Get-CimInstance -Namespace root/MicrosoftDfs -ClassName DfsrReplicatedFolderInfo | Where-Object ReplicationGroupName -eq 'Domain System Volume' | Select-Object ReplicatedFolderName, State, LastErrorCode)}"

• DfsrReplicatedFolderInfo (namespace root\MicrosoftDfs) is the WMI class of DFS Replication that Microsoft documents for each replicated folder of the local computer. "Domain System Volume" is the name of the replication group of SYSVOL, as the dcdiag documentation of Microsoft writes it in the references of a domain controller (cn=domain system volume,cn=dfsr-globalsettings,cn=system).
• The state is State, a number that Microsoft names, returned as a word: uninitialized (0), initialized (1), initial-sync (2), auto-recovery (3), normal (4), in-error (5). Another number is returned as unknown.
• last-error is LastErrorCode, the last error code of DFS Replication on the folder, 0 for success. It stays at its value after the folder recovers: it is shown, not watched.
• No replicated folder in "Domain System Volume" stops the collector as misconfigured: SYSVOL is still replicated by FRS, and its migration to DFS Replication (dfsrmig) is due. An answer that is not the expected JSON, a refused access to the WMI namespace among them, stops it as misconfigured too.

Nothing is written to the Windows: the command only reads.

Prerequisites

• A domain controller running Windows Server 2012 or later, with Windows PowerShell 3.0 or later, and SYSVOL replicated by DFS Replication.
• The OpenSSH server of Windows, installed and started, its default shell left at cmd.exe, the Windows firewall open to the poller on TCP 22, and the fingerprint of its host key set in protocol:ssh:fingerprint unless the Security settings trust the first SSH fingerprint presented: the steps are those of the windows/ssh/services collector of banshee/windows-collection.
• An account of the domain for monitoring, without administrator rights, set in protocol:ssh:user, with its password in protocol:ssh:password or its key in protocol:ssh:private-key. No group is given here: Microsoft does not document who may read root\MicrosoftDfs (see Limits).

Outputs

Watches

A domain controller just promoted goes through initial-sync before normal: the warning says so until it is done.

Limits

• The backlog of SYSVOL is not read. DFS Replication counts it against the version vector of each partner, which is read on the partner itself (GetVersionVector there, then GetOutboundBacklogFileCount here): an SSH session does not always hold credentials it can hand on to another server. The state still turns away from normal when DFS Replication stops replicating.
• Not yet checked on a real domain controller: the execution; that an account without administrator rights may read root\MicrosoftDfs. If it may not, the collector stops as misconfigured with the error of Windows; the namespace is then opened to the account in its WMI security (wmimgmt.msc), in read only ("Enable Account"), never by making it an administrator. Which right lets an account that is not an administrator open an SSH session on a domain controller.