Windows Server: Error 4012 Appears in the DFS Replication Event Log of an Active Directory Domain Controller

Error 4012 (source: DFSR) appears in the DFSR event log of a DC. The event description includes the SYSVOL folder path, as shown here:

The DFS Replication service stopped replication on the folder with the following local path: C:\Windows\SYSVOL\domain. This server has been disconnected from other partners for n days, which is longer than the time allowed by the MaxOfflineTimeInDays parameter (60). DFS Replication considers the data in this folder to be stale, and this server will not replicate the folder until this error is corrected.

[The rest of the event description has been omitted.]

The local path may vary, though this article only applies if it mentions the SYSVOL folder. In the example above, n indicates the number of days the DC has been unable to contact a partner. This number varies but is always greater than the value of MaxOfflineTimeInDays.

Distributed File System Replication (DFSR) requires that replication partners be in regular communication. If a server is unable to communicate with a partner for a long time, replication is disabled on that server.

MaxOfflineTimeInDays, which has a default value of 60, represents the longest allowable time for servers to be out of communication with each other. This is analogous to, though separate from, the tombstone lifetime of an Active Directory forest.

Scenario 1: There is only one DC in the domain.

If there is only one DC in the domain, an authoritative sync of SYSVOL is necessary to ensure that replication occurs if another is added. See How to Perform an Authoritative Sync of SYSVOL Data Using Distributed File System Replication (DFSR) for the steps involved. Any steps that mention other DCs or forcing replication may be skipped.

Scenario 2: There are multiple DCs in the domain.

If there are multiple DCs in the domain, it is necessary to determine how many are affected by the issue. Do so by searching the DFSR event logs of the DCs for error 4012. All affected DCs have this error in their logs in the recent past.

• If only one DC is affected, perform a non-authoritative sync of SYSVOL on that DC. See How to Perform a Non-Authoritative Sync of SYSVOL Data Using Distributed File System Replication (DFSR) for the steps involved.
• If multiple DCs are affected but there are other DCs which are unaffected, perform a non-authoritative sync of SYSVOL on all affected DCs.
• If all DCs in the domain are affected, one DC must be chosen as the authoritative source of SYSVOL data. This requires inspecting the data in the SYSVOL folder hierarchy of each DC and determining which copy is the most current. Once an authoritative source is chosen, perform an authoritative sync of SYSVOL on that DC. See Scenario 1 above for a link to the steps. Perform all steps of the procedure in order to synchronize SYSVOL on all DCs in the domain.

In a multi-DC domain, it may also be possible to resume replication on an affected DC by increasing the value of MaxOfflineTimeInDays. This has not been tested extensively but has resolved the issue on multiple occasions. To set MaxOfflineTimeInDays, run this command:

wmic.exe /namespace:\\root\microsoftdfs path DfsrMachineConfig set MaxOfflineTimeInDays=x

The value of x must be greater than the number of days indicated in error 4012. Restart the DFS Replication service after running the command and check the DFS Replication event log for errors. If replication has been failing for some time, events about conflict detection and resolution are expected. They indicate that DFSR is working as designed.

Once replication has resumed, run the command again with a value of 60 to return MaxOfflineTimeInDays to its default value. (This is optional.)