The Distributed File System Namespaces (DFS-N) service is a role service of the File Service role for Windows Server.
DFS-N, as the name implies, is a distributed file system and it involves a number of components running on a set of computers (Active Directory domain controllers, DFS-N namespace servers, SMB file servers, DFS-N clients that are typically Windows clients, but also Linux ones).
Because of that, as you can imagine, diagnosing problems with DFS-N can be challenging.
To assist with that, Windows Server provides an in-box tool specifically to help with that. It’s called dfsdiag.exe.
DFSDIAG was introduced in Windows Server 2008 and it was improved in Windows Server 2008 R2 to provide better messages and help text.
DFSDIAG is not available as an in-box tool for Windows Server 2003, but the tests can run on Windows Server 2008 or Windows Server 2008 R2 while targeting namespace servers running Windows Server 2003.
The tool will exercise the many components related to DFS-N, so it is recommended to experiment with it in a test lab first to assess its impact, before running it in production.
DFSDIAG can check your configuration in five different ways:
- Checking domain controller configuration.
- Checking site associations.
- Checking namespace server configuration.
- Checking individual namespace configuration and integrity.
- Checking referral responses.
Checking Domain Controller (DC) configuration
Checks the configuration of domain controllers by performing the following tests on each domain controller in the specified domain:
- Verifies that the Distributed File System (DFS) Namespace service is running and that its Startup Type is set to Automatic.
- Checks for the support of site-costed referrals for NETLOGON and SYSVOL.
- Verifies the consistency of the site association by hostname and IP address.
|DFSDiag /TestDCs [/Domain:<domain name>]|
|/Domain:<domain name>: Domain that you want to check.|
Notes: /Domain is an optional parameter. The default value is the local domain that the local host is joined to.
The following is an example:
|DFSDiag /TestDCs /Domain:Contoso.com|
Checking site associations
Checks the configuration of Active Directory Domain Services (AD DS) sites by verifying that servers that act as namespace servers or folder (link) targets have the same site associations on all domain controllers.
|DFSDiag /TestSites | /DFSPath:<namespace root or DFS folder> [/Recurse]> [/Full]|
- /Machine:<server name>: The name of the server on which to verify the site association.
- /DFSPath:<namespace root or DFS folder>: The namespace root or Distributed File System (DFS) folder (link) with targets for which to verify the site association.
- /Recurse: Enumerates and verifies the site associations for all folder targets under the specified namespace root.
- /Full: Verifies that AD DS and the registry of the server contain the same site association information.
The following is an example:
| DFSDiag /TestSites /Machine:MyServer |
DFSDiag /TestSites /DFSPath:\Contoso.comNamespace1\Folder1 /Full
DFSDiag /TestSites /DFSPath:\Contoso.comNamespace2 /Recurse /Full
Checking namespace server configuration
Checks the configuration of a Distributed File System (DFS) namespace by performing the following actions:
- Verifies that the DFS Namespace service is running and that its Startup Type is set to Automatic on all namespace servers.
- Verifies that the DFS registry configuration is consistent among namespace servers.
- Validates the following dependencies on clustered namespace servers that are running Windows Server 2008 or later:
- Namespace root resource dependency on network name resource.
- Network name resource dependency on IP address resource.
- Namespace root resource dependency on physical disk resource.
|DFSDiag /TestDFSConfig /DFSRoot:<namespace>|
|/DFSRoot:<namespace>: The namespace (DFS root) to diagnose.|
Here it is an example:
|DFSDiag /TestDFSConfig /DFSRoot:\Contoso.com\MyNamespace|
Checking individual namespace configuration and integrity
Checks the integrity of the Distributed File System (DFS) namespace by performing the following tests:
- Checks for DFS metadata corruption or inconsistencies between domain controllers.
- Validates the configuration of access-based enumeration to ensure that it is consistent between DFS metadata and the namespace server share.
- Detects overlapping DFS folders (links), duplicate folders, and folders with overlapping folder targets.
|DFSDiag /TestDFSIntegrity /DFSRoot:<dfs root path> [/Recurse] [/Full]|
| /DFSRoot:<dfs root path>: The DFS namespace to diagnose. |
/Recurse: Performs the testing including the namespace interlinks.
/Full: Verifies the consistency of share and NTFS ACLs and client side configuration on all folder targets. It also verifies that the Online property is set.
And now the usual example:
|DFSDiag /TestDFSIntegrity /DFSRoot:\Contoso.comMyNamespace /Recurse /Full|
Checking referral responses
Checks Distributed File System (DFS) referrals by performing the following tests:
- When you use the DFSPath parameter without arguments, this command validates that the referral list includes all trusted domains.
- When you specify a domain, the command performs a health check of domain controllers (Dfsdiag /testdcs) and tests the site associations and domain cache of the local host.
- When you specify a domain and SYSVOL or NETLOGON, in addition to performing the same health checks as when you specify a domain, the command checks that the Time To Live (TTL) of SYSVOL or NETLOGON referrals match the default value of 900 seconds.
- When you specify a namespace root, in addition to performing the same health checks as when you specify a domain, the command performs a DFS configuration check (Dfsdiag /TestDFSConfig) and a namespace integrity check (Dfsdiag /TestDFSIntegrity).
- When you specify a DFS folder (link), in addition to performing the same health checks as when you specify a namespace root, the command validates the site configuration for folder targets (Dfsdiag /testsites) and validates the site association of the local host.
|DFSDiag /TestReferral /DFSPath:<dfs path for getting referrals> [/Full]|
| /DFSPath:<path for getting referrals>: This DFS path can be one of the following: |
(blank): Tests trusted domains.
\Domain: Domain controller referrals.
\DomainSYSVOL: SYSVOL referrals.
\DomainNETLOGON: NETLOGON referrals.
\<domain or server><namespace Root>:Namespace root referrals.
\<domain or server><namespace Root><dfs folder>: DFS folder (link) referrals.
/Full: Applied only to Domain and Root referrals. Verifies the consistency of site association information between the registry and Active Directory Domain Services (AD DS).
Let’s see an example
| DFSDiag /TestReferral /DFSPath:\Contoso.com\MyNamespace |
DFSDiag /TestReferral /DFSPath:\yourNamespace
DFSRDIAG – Where You At?
In the newer builds of Windows Server (like 2012 and 2016), not all of the additional management tools are installed by default. Even though this machine is a DC, and it requires the DFSR service to replicate Sysvol, the additional File Server Management Tools are not present by default. You will have to install them.
Install DFS Management Tools Using PowerShell
Personally we prefer PowerShell as it is quick and simple and less clicking compared to the Server Manager. The syntax to install the DFS management console is below:
Note that this is an isolated test lab, hence the Windows Update message.
Install DFS Management Tools Using Server Manager
You can also use the Server Manager to add in the additional RSAT File Services component which will add in DFSRDIAG.