Replication: How changes, deleted objects, and SYSVOL propagate

1. Core mechanism

This lesson separates two DC replication planes: directory-partition data uses AD DS replication; SYSVOL files use DFSR in domains migrated to DFSR and FRS in legacy FRS domains. A view from one DC is not an instantaneous, forest-wide single truth.

Interfaces and specifications

• Naming context: schema, configuration, domain and application partitions each have their own replication scope.
• AD DS replication is the multi-master flow carrying attribute-level changes between writable DCs.
• Deleted object: a retained directory state that propagates a deletion to other DCs.
• tombstoneLifetime and msDS-DeletedObjectLifetime are forest settings governing the retention windows of deleted objects.
• SYSVOL contains Group Policy templates and logon scripts; it uses DFSR in domains migrated to DFSR and FRS in legacy FRS domains.
• Event 2042: the destination DC stopped inbound replication from the named source partner after their last successful replication interval exceeded tombstone lifetime. This does not describe every partner or outbound path.

Two data planes, two convergence paths

A GPO has two parts: the Group Policy Container (GPC) in the directory and the Group Policy Template (GPT) in SYSVOL. AD DS replication carries the GPC; DFSR carries GPT files in migrated domains, while legacy FRS domains use FRS. Seeing the GPO object on a DC does not prove that its files are ready there at the same time.

AD DS replication is multi-master: each writable DC can accept changes for the appropriate partition. Convergence takes time and is bounded by site-link schedules, reachability and replication topology.

Deletion is replicated state, not immediate absence

When an object is deleted, other DCs must learn that decision. AD DS retains deleted-object state for a retention window. With Recycle Bin enabled, deleted-object lifetime bounds the recoverable phase; tombstone lifetime affects the subsequent retention boundary.

If the replication interval with a particular source exceeds tombstone lifetime, the destination can no longer safely assume it received every deletion. Event 2042 identifies the affected source and stopped inbound path. Review the source/destination context and lingering-object risk before a recovery decision; do not infer that every partner, outbound path or SYSVOL plane has stopped.

SYSVOL has a separate failure boundary

In domains migrated to DFSR, SYSVOL uses DFS Replication; legacy FRS domains replicate SYSVOL with FRS. Directory replication can appear healthy while a backlog or service issue in the configured SYSVOL engine delays policy files; the reverse can also occur.

Authoritative SYSVOL recovery is not ordinary replication. Operations such as msDFSR-Options=1 or wbadmin -authsysvol belong to forest recovery with a deliberately selected source DC; they are not a synchronization button for an ordinary delay.

State and data flow

1. DC-A changes a directory attribute in its local naming context. In this snapshot DC-A holds v2 while DC-B still holds v1.
2. Directory replication delivers the change to DC-B when its prerequisites are met. Partner topology, scheduling and connectivity affect actual latency; this model does not predict elapsed time.
3. A SYSVOL file change follows a separate path; this fixture represents DFSR. A current directory replica does not establish SYSVOL file delivery.
4. Delivering deletion information to relevant partners within retention is a separate requirement. This comparison does not simulate deletion or compute retention.
5. Inspect retention and replication protections separately; a boundary such as Event 2042 cannot be inferred from the two values shown here alone. This model does not generate events.

2. Exploitation

Broken trust assumption

The attacker or faulty manager has the privileges that can make changes to valuetion rights or on a DC; the lesson does not describe unauthorized real environment intervention.

Technical prerequisites

• There are the right on change or valuetion control access on the relevant naming context.
• Download DFSR health signals with Defense AD DS to a single 'DC online' lens.

Exploitation mechanism

Replication authorizations can open a much stronger data access surface than the normal management limit; it is also possible to use the attacker selectively in the delay of the change in the single DC. If the SYSVOL and directory distinguishes review, the policy is incorrectly diagnosed between the file content to be applied with the object.

Replication was not the ordinary read Tags

DS-Replication-Get-Changes-All right allows secret domain data exchangetion. This right is not equivalent to helpdesk type directory read and should be kept in a narrow set of principals.

Zoom delay is not evidence of attack alone; but it can lead to the appearance of critical attribute and SYSVOL changes at different times, misuse of a short window of the attacker or questioning the wrong DC of the defense.

3. Defense & Detection

Telemetry scope

• Give each naming context to valuetion partner, last success and failure status separately.
• Directory Service Event 2042 is primarily based on lingering-object trust limit.
• Keep backlog and event signals from the SYSVOL replication engine configured for the domain (DFSR or legacy FRS) separate from AD DS replication health.
• periodically review of Replication control access rights on domain root ACL.

Events and relevant fields

• 2042 · destination DC reports stopped inbound replication from the named source partner after exceeding tombstone lifetime; other partners and directions require separate evidence.
• 4602 · authoritative SYSVOL success sign; is meaningful in the context of the only related recovery procedure.

Straighten the blood

For a missing directory object, measure naming-context AD DS replication; for a missing policy file, measure the SYSVOL engine configured for the domain (DFSR or legacy FRS). Combining the two engines into one success indicator hides the failure boundary.

2042 is a security limit where the 'old DC is reconnected' call, which is deliberately stopped by automatic valuetion. First source DCs and lingering object risk is determined.

Detection logic · XPath

*[System[(EventID=2042)]]

Query assumptions

• The query selects the Event 2042 envelope on the solo Directory Service channel; the presence of lingering object cannot be proved alone.
• Synthetic artifact has not been taken from a real Windows host and does not claim EventData chart.

False positives

• As planned, a long-term offline arrested DC can also reach the same trust limit, which is still a condition to be verified operationally.
• Absence of Event 2042 does not show that DFSR or legacy FRS SYSVOL replication is healthy.

Hardening

• Limit and track domain root DACL changes with the Floribly privilege.
• For a long time offline DCs are removed from the service controlledly before the chub lifetime is vaccinated or apply a safe return plan.
• Use separate health gates and recovery runbooks for AD DS and the SYSVOL replication engine configured for the domain.
• Apply Authoritative SYSVOL recovery with only verified forest recovery scenario and backup/rol plan.

Read the examples

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-ActiveDirectory_DomainService"/><EventID>2042</EventID><Level>2</Level><Channel>Directory Service</Channel><Computer>DC-BRANCH.outreason.example</Computer></System></Event>

Two reality checks

Assumption: If ADchangetion is healthy, SYSVOL is healthy at the same time and with the same motor.

In fact: No. Directory partitions spread with AD DS valuetion, SYSVOL files DFSR; topology of two planes, backlog and failure signals are individually verified.

Assumption: Silinen object instantly disappears physically from all DCs.

In fact: It is a directory status that should be duplicated. The Retention window allows other DCs to learn to delete; the risk of kopukluk lingering object exceeding the window.

Sources

• Microsoft · Active Directory Replication Concepts
  Replication model, topology, and naming context scope.
• Microsoft Open Specifications · Tombstone Lifetime and Deleted-Object Lifetime
  Definitions of tombstoneLifetime and msDS-DeletedObjectLifetime.
• Microsoft · Migrate SYSVOL replication to DFS Replication
  DFSR scope and migration states for SYSVOL.
• Microsoft · Active Directory replication Event ID 2042
  Inbound replication stops after the tombstone-lifetime threshold; EventData is not reconstructed.
• Microsoft · Perform an authoritative synchronization of DFSR-replicated SYSVOL
  Forest-recovery authoritative synchronization and verification with DFSR Event 4602.
• Microsoft · Active Directory replication Event ID 2042
  Cause and event text: destination DC stops inbound replication with named source partner.