Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. SYSVOL
FolderRisk: Do not touch
  • Windows Server

SYSVOL C:\Windows\SYSVOL

C:\Windows\SYSVOL: a domain controller's replicated folder, with GPO files and logon scripts (the SYSVOL and NETLOGON shares).

Updated on By AltF4 Formation

What it’s for

SYSVOL is the folder replicated between the controllers of a domain. It stores the file-based part of Group Policy objects and logon scripts. Clients reach it through the SYSVOL and NETLOGON shares. The default location is %systemroot%\SYSVOL, which you choose when promoting the controller. So the settings of a domain GPO live here, while those of the local policy live in System32\GroupPolicy.

What it contains

  • domain: the real content. Policies has one folder per GPO, named by its GUID, with the same layout as the local policy (Machine, User, gpt.ini). scripts is the folder behind the NETLOGON share.
  • sysvol: the folder the SYSVOL share publishes. It holds a junction named after the DNS domain, which points to domain.
  • staging and staging areas: the intermediate replication areas, with the same junction logic.
  • domain\DfsrPrivate: DFSR internals (files in transit, conflicts). The DFSR database itself is in System Volume Information\DFSR at the root of the volume.

Risks and best practices

  • The junctions and content replicate between controllers, so moving, renaming or deleting anything here stops Group Policy from applying and makes controllers drift apart.
  • Edit GPOs with the Group Policy Management console, never through the file system.
  • Restrict write access: a script altered here runs for every user in the domain.
  • On a controller whose SYSVOL and NETLOGON shares are missing, follow Microsoft’s procedure to rebuild the tree.
  • Check that replication goes through DFSR and not the old FRS: dfsrmig /getglobalstate should answer “Eliminated”.

Useful commands

Fenêtre de terminal
# Shares published by the domain controller
Get-SmbShare -Name SYSVOL, NETLOGON | Select-Object Name, Path


# Group Policy and script folders (read-only)
Get-ChildItem "$env:windir\SYSVOL\domain" -Force | Select-Object Name
Get-ChildItem "$env:windir\SYSVOL\domain\Policies" -Directory | Select-Object Name


# FRS to DFSR migration state (as administrator, on a domain controller)
dfsrmig /getglobalstate


# Health of SYSVOL and the shares on this controller
dcdiag /test:sysvolcheck /test:netlogons

Folder contents

Folders 2

Report a mistake