Please explain me why I have to add just some registry keys to repair sysvol-replication.
Because that's the way FRS was designed. The service monitors the NTFS USN journal in order to detect changes to files that need to be replicated. If the service is left stopped for too long (while the USN journal continues to increment,) or if the frequency of changes on the NTFS volume is too great, the USN journal can "wrap" without the FRS service there to witness it and the FRS service doesn't know how to proceed. In order to protect you from unintended data loss, FRS doesn't try to "self-heal," it waits patiently for an administrator to manually intervene.
I have read somewhere the sysvol backup is included in system state backup, but in the manual there is a note which tells you it doesn't include sysvol and where the backup will appear?
SYSVOL is included in a system state backup. It's usually stored at %Windir%\SYSVOL
. But if you don't restore it authoritatively, (D4,) it might get overwritten by another domain controller after you restore it.
Edit: Let me clarify the previous statement:
Note System state backups for Windows domain controllers do not
include the FRS database that maintains state information for the FRS
service pertaining to the files within the SYSVOL folder and other
content sets. The FRS database, debug logs, staging area files, and
files in the pre-existing data folder are excluded from a system state
backup. The following sample FRS writer specification contains the
exclusion list in the "Excluded files" section.
The files themselves are included in a system state backup, but the database is not, therefore you have to perform a restore (either D2 or D4) to make it a functional FRS replica again. A restore of FRS rebuilds the database.
D2 is the safer alternative - it simply re-downloads everything in SYSVOL from another replication partner. D4 is the "authoritative" mode, which is more involved because you have to go touch every DC, and it forces every DC to redownload from the authoritatively restored master. Don't D4 unless you're really neck deep in shit creek with your mouth wide open.
Here's the info about the automatic restore" registry key:
By default, versions of the Ntfrs.exe file from Windows 2000 Service
Pack 3 (SP3) and from Windows 2000 SP3 hotfix do not perform an
automatic nonauthoritative restore (for example, SP3 leaves content in
place as 2195 and SP1 left the context in place) when journal wrap
errors are detected. SP3 versions of NTFRS may be configured to
function like SP2 when the "Enable journal wrap automatic restore"
registry entry is set to 1 in the following registry subkey:
HKLM\System\Ccs\Services\Ntfrs\Parameters
Important We do not
recommend that you use this registry setting, and this setting should
not be used versions of Windows after the Service Pack 3 version of
Windows 2000. The recommended method for performing a nonauthoritative
restore on FRS members of DFS or SYSVOL replica sets is to use the FRS
BurFlags registry value.
See the section in bold? Don't use this registry key. Why not? Unintended data loss, that's why. FRS is old and busted and you should have stopped using it 10 years ago.