When the SYSVOL or NETLOGON share is missing on a Domain Controller, Group Policy, logon scripts and the health of the DC are all affected. Instead of creating the shares by hand, find out why SYSVOL never became ready and whether the problem is in DFS Replication (DFSR) or in Active Directory replication.
Problem and symptoms
- SYSVOL or NETLOGON does not appear in the
net shareoutput. - Group Policy is not applied to clients.
- SYSVOL is not ready on a new or existing DC.
- There are errors in the DFS Replication or Directory Service event logs.
1. Check the shares
net shareIf they are missing, review the replication state before you create any share yourself.
2. Run Domain Controller diagnostics
dcdiag /test:advertising
dcdiag /test:sysvolcheck
dcdiag /test:netlogons3. Check Active Directory replication health
repadmin /replsummary
repadmin /showreplDo not treat a SYSVOL problem as a DFSR problem only; AD replication has to be healthy as well.
4. Review the DFS Replication event log
In Event Viewer, open Applications and Services Logs → DFS Replication and review the events from the same time window as the SYSVOL problem. Read these events in context:
- 2213: DFSR stopped replication and is waiting for recovery.
- 4012: replication stopped because the server was disconnected for too long.
- 4614: SYSVOL is waiting for initial synchronization.
- 4604: SYSVOL initial synchronization has completed.
The presence of an event alone is not a reason to run an automatic repair command.
5. Check the DFSR service
Get-Service DFSRRestarting the service over and over does not fix an underlying replication or configuration problem.
6. Check the SYSVOL ready state
On the Domain Controller, check the SysvolReady value under HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters for diagnosis only. Setting it to 1 by hand does not complete DFSR initial synchronization and can hide the real problem.
7. Verify DNS and DC Locator
nltest /dsgetdc:contoso.com
dcdiag /test:dnscontoso.com is only an example; use your own AD domain name.
My troubleshooting flow
- Confirm the state with
net share. - Run the DCDiag SYSVOL and Netlogon tests.
- Check AD replication.
- Review the DFS Replication events.
- Verify the DFSR service and the SYSVOL ready state.
- Rule out DNS and DC Locator problems.
- After fixing the root cause, verify the shares and Group Policy again.
Safety and best practices
Before any advanced operation such as an authoritative or non-authoritative SYSVOL recovery, determine exactly which DC holds the correct data and what the current replication topology looks like. In production, do not change the registry or the DFSR state without verifying them first.
Validate after the fix
After the root cause is fixed, confirm with net share that SYSVOL and NETLOGON are shared, and that dcdiag /test:sysvolcheck and dcdiag /test:netlogons pass. Also check the SYSVOL content and GPO access; seeing the share names alone is not enough.
Conclusion
A missing SYSVOL or NETLOGON share is more than a missing share name. Use DCDiag, Repadmin, the DFS Replication logs and the DNS checks together to find out why the DC could not make SYSVOL ready.