sysvol

SYSVOL replication, by WinRM

Returns the DFS Replication state of SYSVOL on a domain controller, and the last error DFS Replication noted on it. One watch is proposed, checked: SYSVOL that is not in its normal state.

How it works

The collector runs one PowerShell script, by WinRM, that reads the replicated folders of DFS Replication and keeps the one of the replication group "Domain System Volume", which replicates SYSVOL:

$ErrorActionPreference = 'Stop'; [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding; ConvertTo-Json -Compress -Depth 4 -InputObject @{folders = @(Get-CimInstance -Namespace root/MicrosoftDfs -ClassName DfsrReplicatedFolderInfo | Where-Object ReplicationGroupName -eq 'Domain System Volume' | Select-Object ReplicatedFolderName, State, LastErrorCode)}

• WinRM hands the script to PowerShell itself: the script is the one of active-directory/ssh/sysvol, without the powershell -Command "…" that cmd.exe needs there.
• DfsrReplicatedFolderInfo (namespace root\MicrosoftDfs) is the WMI class of DFS Replication that Microsoft documents for each replicated folder of the local computer. "Domain System Volume" is the name of the replication group of SYSVOL, as the dcdiag documentation of Microsoft writes it in the references of a domain controller (cn=domain system volume,cn=dfsr-globalsettings,cn=system).
• The state is State, a number that Microsoft names, returned as a word: uninitialized (0), initialized (1), initial-sync (2), auto-recovery (3), normal (4), in-error (5). Another number is returned as unknown.
• last-error is LastErrorCode, the last error code of DFS Replication on the folder, 0 for success. It stays at its value after the folder recovers: it is shown, not watched.
• No replicated folder in "Domain System Volume" stops the collector as misconfigured: SYSVOL is still replicated by FRS, and its migration to DFS Replication (dfsrmig) is due. An answer that is not the expected JSON, a refused access to the WMI namespace among them, stops it as misconfigured too.

Nothing is written to the Windows: the script only reads.

Prerequisites

• A domain controller running Windows Server 2012 or later, with Windows PowerShell 3.0 or later, and SYSVOL replicated by DFS Replication.
• The WinRM service listening in HTTPS, on TCP 5986 or the port set in protocol:winrm:port, open in the Windows firewall to the poller, with a certificate the poller judges by the TLS profile of the probe or pins in protocol:winrm:fingerprint: the steps are those of the windows/winrm/services collector of banshee/windows-collection. NTLM authentication, which the WinRM service accepts as installed.
• An account of the domain for monitoring, without administrator rights, set in protocol:winrm:user (DOMAIN\account or account@domain) with its password in protocol:winrm:password, member of the group "Remote Management Users" of the domain (on a domain controller, the built-in group of the Builtin container). No other group is given here: Microsoft does not document who may read root\MicrosoftDfs (see Limits).

Outputs

Watches

A domain controller just promoted goes through initial-sync before normal: the warning says so until it is done.

Limits

• The backlog of SYSVOL is not read. DFS Replication counts it against the version vector of each partner, which is read on the partner itself (GetVersionVector there, then GetOutboundBacklogFileCount here): a WinRM session authenticated by NTLM cannot hand the credentials of the account on to another server. The state still turns away from normal when DFS Replication stops replicating.
• Not yet checked on a real domain controller: the execution; that an account without administrator rights may read root\MicrosoftDfs. If it may not, the collector stops as misconfigured with the error of Windows; the namespace is then opened to the account in its WMI security (wmimgmt.msc), in read only ("Enable Account"), never by making it an administrator.