Dangerous SYSVOL Replication Configuration



"File Replication Service" (FRS) is deprecated since Windows Server 2008 R2. Tenable highly recommends migrating the SYSVOL share replication from FRS to "Distributed File System Replication" (DFS-R) for better robustness, scalability, and replication performance.


Microsoft recommends using the recent and supported DFS-R protocol for SYSVOL replication. You must migrate SYSVOL shares still using "File Replication Service" (FRS) to "Distributed File System Replication" (DFS-R) manually following the procedure from Microsoft.

See Also

FRS Technical Reference

Windows Server version 1709 no longer supports FRS

DFS Replication FAQ

The Case for Migrating SYSVOL to DFSR

Importing a GPO using GPMC fails with "The Directory is not empty"

Active Directory Security Assessment Checklist - SYSVOL replication through NTFRS

Indicator Details

Name: Dangerous SYSVOL Replication Configuration


Severity: Medium

MITRE ATT&CK Information:

Tactics: TA0005

Techniques: T1484.001