Importing a GPO using GPMC fails with "The Directory is not empty"

Applies to: Windows Server 2008 EnterpriseWindows Server 2008 R2 EnterpriseWindows Server 2008 R2 Standard More

Symptoms


Importing a saved GPO using Group Policy Management Console (GPMC) sporadically fails with an error dialog "The Directory is not empty".

Cause


During Import of the Policy settings, GPMC creates several temporary directories (staging) and backups the old settings in separate folders.

As the Import is done on the SysVol share, DFSR replication might interfere with the import sequence and therefore show the above error.

Resolution


Workaround #1

To prevent the conflicting operations from occurring, use DFSRDIAG.EXE to suspend replication on the DC the GPMC import is happening on. The command requires the user to specify the Replication Group name, the Partner name (in this case the DC used for the import is the partner) and the amount of time in minutes to suspend replication. DFSR will automatically resume replication once the number of minutes specified has elapsed.


1. Open an administrative command prompt
2. Run this command DFSRDIAG StopNow /rgname:”Domain System Volume” /partner:<DcName> /time:<number of minutes to suspend replication> 
3. Import the Group Policy 

Note: DFSR will log event 5106 when replication is stopped and again when it resumes. You can use these events to monitor the service state.

Event 5106 when replication is paused

Log Name:      DFS Replication
Source:        DFSR
Event ID:      5106
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Description:
The replication mode on the connection to partner <Dc Name> has changed. 
 
Additional Information: 
Previous Replication Mode: Obey Configured Schedule 
Current Replication Mode: Stop Replication 
Current Bandwidth Usage:  Full 
Duration, in minutes, for current mode: 5 
Connection ID: 79E6D60D-6044-4775-A9BE-D98DAF557BD6 
Replication Group ID: Domain System Volume

Event 5106 when replication is Resumed

Log Name:      DFS Replication
Source:        DFSR
Event ID:      5106
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Description:
The replication mode on the connection to partner <DC Name> has changed.
 
Additional Information:
Previous Replication Mode: Stop Replication
Current Replication Mode: Obey Configured Schedule
Current Bandwidth Usage: Obey Configured Schedule
Duration, in minutes, for current mode:  
Connection ID: 79E6D60D-6044-4775-A9BE-D98DAF557BD6
Replication Group ID: Domain System Volume

Workaround #2

To resolve the issue, in case the import needs to happen more often, add a filter for DFSR to exlude the tempory directories from replication. These temporary directories are:
  • MachineOld
  • UserOld
  • MachineStaging
  • UserStaging
  • AdmOld
To modify the DFSR filter, edit this object in AD as mentioned below:

CN=SYSVOL Share,CN=Content,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=Contoso,DC=Com
and modify the msdfsr-directoryfilter attribute.

Append the 5 directories to the end of the already exsiting exlcusions, it should look like this:

DO_NOT_REMOVE_NtFrs_PreInstall_Directory,NtFrs_PreExisting___See_EventLog,MachineOld,UserOld,MachineStaging,UserStaging,AdmOld
To make DFSR read the new settings from AD, run "dfsrdiag PollAD"