Windows 10: DFS Referral Cache Is Invalid and Not Automatically Refreshing

After updating existing DFS-N target folders, clients Win10, Win2019, etc. with existing cache DFS-N referral gives ‘Element Not Found’ in File Explorer GUI or ‘Cannot find path ... because it does not exist’ in CLI errors. Upon investigation, finding DFS-N referral cache entry listed as 'Type: 0x10 OUTSIDE_MY_DOM ' but Expires is not honored and entry is stuck in local cache. The entry is a DFS-N domain path entry, the cached result is incorrect.Work-around: Only restarting the client, or installing RSAT DFS Management tools DFSUTIL can flush the referral cache. Because DFSUTIL is

:)

 

DFS Referral Cache Is Invalid and Not Automatically Refreshing

New question posted here: DFS Referral Cache Is Invalid and Not Automatically Refreshing - Microsoft Q&A

 

DFS Referral Cache Is Invalid and Not Automatically Refreshing

After updating existing DFS-N target folders, clients (Win10, Win2019, etc.) with existing cache DFS-N referral gives ‘Element Not Found’ (in File Explorer GUI) or ‘Cannot find path ... because it does not exist’ (in CLI) errors.

Upon investigation, finding DFS-N referral cache entry listed as 'Type: 0x10 ( OUTSIDE_MY_DOM )' but Expires is not honored and entry is stuck in local cache. The entry is a DFS-N domain path entry, the cached result is incorrect.

Work-around: Only restarting the client, or installing RSAT DFS Management tools (DFSUTIL) can flush the referral cache. Because DFSUTIL is not something that can be remotely executed, there is no solution without touching the client to install the utility.



Updated DFS-N target folder







Client referral cache contents







Client error message







Recovery step 1. Delete original DFS-N target folder, re-create a new target to eliminate the false ‘Type:0x10’ ‘( OUTSIDE_MY_DOM )’ error condition.







Recovery Step 2. Restart Client. Or Use Recovery Procedure 3.



Recovery Step 3a. Add RSAT DFSUTIL to client.







Recovery Step 3b. DFSUTIL cache referral flush.

 

DFS cache issue

We have a domain which has 6 different sites, 3 of the sites has a DC and a DFS server. To make this easier to see:
Site A: DC + DFS + PCs

Site B: DC + DFS + PCs

Site C: DC +DFS + PCs

Site D: just PCs, all PCs point DNS to site A plus DFS

Site E: just PCS all PCs point DNS to site A plus DFS

Site F: just PCs all PCs point DNS to site A plus DFS.

All PCs (all windows 10) in the entire network got built at site A then physically installed at each site.

The DFS issue is that we have 2 shares Share A and Share B that get pushed out via gpo to all users and all sites and PCs. The issue is Share A and B both appear but when you click on them it says "K:\ is not unavailable, if the location is connected or the disc is inserted, and then try again. If the location is on a network, make sure you're connected to the network or internet, and then try again. If the location still cant be found, it might have been moved or deleted." If you wait about 20 minutes or so then the Shares both work at site E and F. This does NOT happen at every site. Sites A, B, C, and D are fine. Site E and F have the issues. All sites have the exact same group policies. If I rebuild a PC at site E or F and rejoin it to the domain they pick up the shares and they work fine. But I dont want to have to rebuild every PC that has the issue. If I clear the DFS cache on the PCs that cant access the shares using the commands (as an admin) "dfsutil cache referral flush" or even "dfsutil /spcflush" it flushes the DFS cache and then after about 2 minutes, the shares appear and work. The issue is though, when I reboot the PCs at sites E and F after clearing the cache they then have the DFS issue after reboot as if it picks up its cached DFS issue from somewehre again. The only way is to rebuild them, which long.

I have checked ADSI to see if there are any old DFS servers or paths still around, there isn't. I have checked that all DFS servers have access based enumeration checked on both shares, they do, they all match. I have ran "DFSDiag /TestDFSIntegrity /DFSRoot:\\domain.com\Fileshares /Recurse" on all servers, there all ok. I have ran dcdiag on the DCs, all came back ok with no issues. if I run 'dfsutil /pktinfo" on a faulty client PC they point to the correct share paths.

One thing I did notice which was a bit weird was that when I ran 'dfsutil /spcinfo' on each DFS server, I found Site B DFS had a * symbol within its actual name output below (but the PCs with the issues are trying to pull the shares from Site A I believe as thats where it gets them from when they do actually work):
[*][2003server1.contoso.com*contoso.com] - There should not be a * symbol within the name itself as shown here.

[*][CONTOSO]

[*][contoso.com]

[+][CONTOSO]

[-2003server2]

[+2003server1]

[-][contoso.com]

I am out of ideas... any ideas help will be gratefully appreciated. Is there somewhere I can see where the cached DFS info lies or gets pulled from?