Deploying a GPO does not complete and the Live GPO loses its settings (4211553)

Deploying a GPO may fail or go into a pending state and the Live GPO settings go missing or are corrupted between Check In and deploy.

The following error may be shown in the DFSR log:

Event 4412

The DFS Replication service detected that a file was changed on multiple servers.
A conflict resolution algorithm was used to determine the winning file.
The losing file was moved to the conflict and deleted folder.

The following errors may also be shown in GPOAdmin:

WORKAROUND

When an import happens frequently (as it does during the GPO Admin check in/check out process), add a filter for DFSR to exclude the temporary directories from replication that are created during staging.
These temporary directories are:

• MachineOld
• UserOld
• MachineStaging
• UserStaging
• AdmOld

For Windows Server 2008 and above

To modify the DFSR filter, edit this object in AD using ADSI Edit:
1. connect to “Default naming context”
2. CN=SYSVOL Share,CN=Content,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=domain,DC=Com
3. Modify the msdfsr-directoryfilter attribute.
4. Append the 5 directories to the end of the already existing exclusions; The value should look like this:
DO_NOT_REMOVE_NtFrs_PreInstall_Directory,NtFrs_PreExisting___See_EventLog,MachineOld,UserOld,MachineStaging,UserStaging,AdmOld
5. To make DFSR read the new settings from AD, run dfsrdiag PollAD from a Domain controller.

For Windows Server 2000/2003

1. Start the Active Directory Users and Computers snap-in.
2. On the View menu, verify that the Advanced Features command has a check mark.
3. In the left pane, double-click System, then double-click File Replication Service.
4. Right-click Domain System Volume (Sysvol share), and then click Properties.
5. On the Replica Set tab, configure the file and folder filters that you want. (MachineOld,UserOld,MachineStaging,UserStaging,AdmOld)
6. Click OK to save the settings.

Once completed this will prevent the Staging folders from being replicated by DFSR and prevent the folders being overwritten with blank folders.

To locate any existing staging folders you can run the following commands a Domain Controller:
dcdiag /v /c /d /e > c:\dcdiag.txt
repadmin /showrepl * /verbose /all /intersite > c:\repl.txt

The following is in two parts, the second part refers to the DCList.txt that is output in the first part:
Dsquery server -o rdn -forest > C:\DCList.txt<BR>FOR /F "Tokens=*" %L IN (C:\DCList.txt) DO DIR /s \\%L\SYSVOL | Find /i "staging" >> C:\Result.TXT

Once completed you can review the output in Results.txt to find any other staging folders that exist in the sysvol folders.
Results.txt