System State Restore Fails on Windows Server 2008 R2 Read-Only Domain Controller

Article ID: 2001977 - View products that this article applies to.
Expand all | Collapse all

Symptoms

When you attempt to perform a system state restore on a Windows Server 2008 R2 read-only domain controller (RODC), the operation fails with the following error:

The recovery of the system state failed [Date - Time].
Log of files successfully recovered:
C:\Windows\Logs\WindowsServerBackup\SystemStateRestore-Date-Time.log

Log of files for which recovery failed:
C:\Windows\Logs\WindowsServerBackup\SystemStateRestore_Error-Date-Time.log

If you look in the error log you will see lines similar to this:

Error Restoring C:\Windows\SYSVOL\domain\ during write: Error [0x80070005] Access is denied.
Error Restoring C:\Windows\SYSVOL\domain\DfsrPrivate\ during write: Error [0x80070005] Access is denied.
Error Restoring C:\Windows\SYSVOL\domain\DfsrPrivate\ during write: Error [0x80070005] Access is denied.
Error Restoring C:\Windows\SYSVOL\domain\Policies\ during write: Error [0x80070005] Access is denied.
Error Restoring C:\Windows\SYSVOL\domain\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\ during write: Error [0x80070005] Access is denied.
Error Restoring C:\Windows\SYSVOL\domain\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\GPT.INI during write: Error [0x80070005] Access is denied.

Cause

On Windows Server 2008 R2 read-only domain controllers the Distributed File System Replication (DFSR) service uses a filter driver to prevent modifications to SYSVOL data. While booted into Directory Services Restore Mode the DFSR filter driver is still protecting the SYSVOL directory, thereby preventing the restore of files to the SYSVOL directory.

Resolution

To resolve this issue unload the DFSR read-only filter driver before trying to restore the system state on a domain controller. To successfully restore the system state on a read-only domain controller, use these steps:

  1. Run this command from an elevated command window to unload the DFSR read-only filter driver:

    Fltmc unload DfsrRo

  2. Restore your system state backup.

  3. Load the DFSR read-only filter driver with this command:

    Fltmc load DfsrRo

More Information

After a system state restore on a RODC the Sysvol replicated folder will perform an initial synchronization and the contents of Sysvol will be replicated from a writeable domain controller.
Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.

Properties

Article ID: 2001977 - Last Review: October 2, 2009 - Revision: 3.0
APPLIES TO
  • Windows Server 2008 R2 Enterprise
  • Windows Server 2008 R2 Standard
Keywords: 
KB2001977

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com