Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
  5. Logs
  6. DFS Replication.evtx
LogRisk: Caution
  • Windows Server

DFS Replication.evtx C:\Windows\System32\winevt\Logs\DFS Replication.evtx

DFS Replication log: events from the DFS Replication service, including SYSVOL replication on a domain controller.

Updated on By AltF4 Formation

What it’s for

DFS Replication.evtx is fed by the DFS Replication service. On a domain controller, this service replicates SYSVOL (Group Policy and scripts) between controllers, so this log is the first place to look when SYSVOL or NETLOGON is not shared or policies differ from one controller to another. On a file server it tracks DFS replication groups. It only exists where the DFS Replication role is present. For how .evtx files work in general, see the winevt\Logs folder page.

What it contains

  • SYSVOL replication start-up: 4614 (initialized, waiting for initial sync), 4604 (initial sync completed), 4602 (replication initialized successfully).
  • Interrupted or late replication, for example 4012: replication has been stopped for longer than the allowed offline time.
  • Unclean shutdowns: 2212 reports an unexpected shutdown on the volume, 2213 the replication suspended as a result until it is resumed manually.
  • Errors about shares, conflict resolution or staging space.

Risks and best practices

  • Do not edit SYSVOL by hand to “force” replication. Follow the Microsoft procedure that matches the event you found: a 2213 is fixed differently from a 4012.
  • Export the log before any recovery operation.
  • Failing SYSVOL replication leaves Group Policy different from one controller to the next. Put these IDs in your monitoring.

Useful commands

Fenêtre de terminal
# Common replication alerts (as administrator)
Get-WinEvent -FilterHashtable @{LogName='DFS Replication'; Id=4012,2212,2213} -MaxEvents 20 |
    Select-Object TimeCreated, Id, Message


# Are the SYSVOL and NETLOGON shares present?
Get-SmbShare -Name SYSVOL, NETLOGON
Fenêtre de terminal
:: Replication state between controllers
dfsrdiag replicationstate


:: SYSVOL check with dcdiag
dcdiag /test:sysvolcheck /test:advertising

Format

Binary XML file (.evtx).

Rotation and archiving

Maximum size and retention are set in the log properties or through Group Policy. Keep a copy before a recovery: wevtutil epl "DFS Replication" C:\Temp\DFSR.evtx.

How to read it

Event Viewer, “Applications and Services Logs”, “DFS Replication”. Filter by level, then read the full message: it names the replication group and folder involved. For an exported file: Get-WinEvent -Path.

Report a mistake