You cannot perform a system state restore in the Directory Service Restore mode on a read-only domain controller that is running Windows Server 2008 R2 if DFS Replication is used to replicate the SYSVOL folder

Consider the following scenario:

• A read-only domain controller that is running Windows Server 2008 R2 uses Distributed File System (DFS) Replication to replicate the SYSVOL folder.
• You perform a system state backup operation on this read-only domain controller. For example, at the command prompt, you type the following command:
  
  wbadmin.exe start systemstatebackup -backuptarget:letterdrive
• You restart the read-only domain controller in the Directory Service Restore mode to restore the system state.

In this scenario, when you try to perform the system state restore, you receive the following error message: Note A read-only domain controller is configured when you select the Read-only domain controller (RODC) check box in the Active Directory Domain Services Installation Wizard.

This issue occurs because a DFS Replication-related filter driver (DfsrRo.sys) is incorrectly loaded when the computer is in the Directory Service Restore mode. This behavior blocks the restore process.

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

To apply this hotfix, your computer must be running Windows Server 2008 R2.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace a previously released hotfix.

File information

The English (United States) version of this hotfix installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.

Windows Server 2008 R2 file information notes

• The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately in the "Additional file information for Windows Server 2008 R2" section. MUM and MANIFEST files, and the associated security catalog (.cat) files, are extremely important to maintaining the state of the updated component. The security catalog files, for which the attributes are not listed, are signed with a Microsoft digital signature.

For all supported x64-based versions of Windows Server 2008 R2

Workaround for Windows Server 2008 R2

To work around this issue, follow these steps:

1. Start the server in the Directory Services Restore mode.
2. At the command prompt, type the following command, and then press ENTER:
   Fltmc unload DfsrRo
3. Perform a system-state restore operation.
4. Reload the filter driver, by doing the following. At the command prompt, type the following command, and then press ENTER:
   Fltmc load DfsrRo

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

In Windows Server 2008 R2, the DFS Replication service introduces a "read-only replicated folders" feature. This feature is used for the SYSVOL replicated folder on a read-only domain controller. A read-only filter driver prevents the read-only replicated folder from being changed except when the DFS Replication service tries to make a change. Therefore, when you perform a system state restore on a read-only domain controller that is running Windows Server 2008 R2, the restore operation fails.

When you perform a system state restore in the Directory Services Restore mode, the DFS Replication read-only filter driver is still loaded because the filter driver is loaded as a system boot driver. Additionally, the filter driver is loaded regardless of whether the service has started or not. Therefore, the filter driver prevents the backup application from restoring the contents of the SYSVOL replicated folder.

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base: -

Additional file information

Additional files for all supported x64-based versions of Windows Server 2008 R2

For more information about the release notes for Windows Server 2008 R2, visit the following Microsoft Web site.
http://technet.microsoft.com/en-us/library/dd392259(WS.10).aspx
For more information about how to use Windows Server Backup program to back up system state, visit the following Microsoft Web site.
http://technet.microsoft.com/en-us/library/cc742124(WS.10).aspx
For more information about how to use Windows Server Backup program to restore system state, visit the following Microsoft Web site.
http://technet.microsoft.com/en-us/library/cc742035(WS.10).aspx