1350 - AD server recovery shows SYSVOL empty except for “NtFrs_PreExisting___See_EventLog”

Symptom

On restoring an Active Directory server, the SYSVOL location is empty except for a folder named “NtFrs_PreExisting___See_EventLog”.

Cause

The root cause is that the SYSVOL replication is using the File Replication Service (FRS) when it should be using the Distributed File System (DFS). This occurs because AD configured on Windows Server 2000 and 2003 used FRS, whereas AD configured on Server 2008 and onwards uses DFS. However, users upgrading to Server 2008/2012 were not forced to update to DFS. (Note that upgrading to 2016/2019 does require updating.)

To confirm the problem:

Run the following on the AD command-line:

DfsrMig /GetMigrationState
DfsrMig /GetGlobalState

A result of 0/1/2 means the migration from FRS to DFS is in progress. A result of 3 means the migration to DFS is complete (ELIMINATED). A message “DFSR migration has not yet initialized” means you are still using FRS.

Solutions

• If the backup servers are still alive: Update from FRS to DFS, back up again, then retry the recovery. (See this article from Microsoft.)
• If the backup servers are dead: This will require some manual effort. See this article from Microsoft, and be sure to change all the registry entries for every server you have restored, both as authoritative and accepting.