{"id":4698,"date":"2020-07-02T02:36:14","date_gmt":"2020-07-02T02:36:14","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=4698"},"modified":"2020-06-02T02:37:00","modified_gmt":"2020-06-02T02:37:00","slug":"ad-sysvol-version-mismatch-server-2008-to-server-2016-upgrade","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/ad-sysvol-version-mismatch-server-2008-to-server-2016-upgrade","title":{"rendered":"AD \/ SYSVOL Version Mismatch – Server 2008 to Server 2016 Upgrade"},"content":{"rendered":"

\"\"<\/p>

Server 2008 and prior domain controllers create two Domain Admin accounts with permissions on the GPOs.\u00a0 We could not see both in the GUI but when we ran icacls {GPO UID} on the Server 2008 domain controller you see both Domain Admin accounts.<\/p>

Server 2012 and newer domain controllers only create a single Domain Admin account with access.\u00a0 In the 2018.6C (June 21 Rollup, links below) patch for 2016 and 2012R2, a new function was introduced to remove duplicate ACEs in order to reduce the NTFS Security Descriptor stream size. Machines with this patch will no longer write that duplicate ACE, thereby making them inconsistent with the unpatched ones.<\/p>

To fix we logged into the Server 2008 domain controller and ran the following command against all the GPOs to remove both domain admin account<\/p>

icacls “{GPO UID}” \/remove:g “<localdomain>\\Domain Admins”<\/strong><\/p>

Then the following command to add a single Domain Admin account back to the GPO<\/p>

icacls “{GPO UID}” \/grant “<localdomain>\\Domain Admins”:(OI)(CI)(F)<\/strong><\/p>

We then we forced replication again with these two commands<\/p>

repadmin \/syncall<\/strong><\/p>

repadmin \/syncall \/AdePq<\/strong><\/p>

After that we re-ran the Detect Now on the server 2016 and all servers were green.<\/p>

IMPORTANT NOTE:<\/p>

If you create a new policy on Server 2008 it will get the second domain admin account again.\u00a0 So to prevent it from happening going forward you should create the GPOs on Server 2016.<\/p>","protected":false},"excerpt":{"rendered":"

Server 2008 and prior domain controllers create two Domain Admin accounts with permissions on the GPOs.\u00a0 We could not see both in the GUI but when we […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[2489,1457,3281,1677,3282],"class_list":["post-4698","post","type-post","status-publish","format-standard","hentry","category-research","tag-2489","tag-1457","tag-ad-sysvol-version-mismatch","tag-domain-controller","tag-icacls"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t