Week 8 – Manage Sites and Replication • Configure Sites and Subnets • Configure the Global Catalog and Application Partitions • Configure Replication 1 Understand Sites • Loosely related to network “sites” A highly connected portion of your enterprise • Active Directory objects that support Replication • Active Directory changes must be replicated to all DCs • Some DCs might be separated by slow, expensive links • Balance between replication “cost” & convergence Service localization • DC (LDAP & Kerberos) • DFS • Active Directory–aware (site aware) apps • Location property searching, for example, printer location 2 Plan Sites • Active Directory sites may not map one-to-one with network sites Two locations, well connected, may be one Active Directory site A large enterprise on a highly connected campus (one “site”) may be broken into multiple Active Directory sites for service localization • Criteria Connection speed: < 512 kbps link is slow speed. Service placement: If no DCs or Active Directory–aware services, not much point in a site User population: If the number of users warrants a DC, consider a site Directory query traffic by users or applications Desire to control replication traffic between DCs 3 Create Sites • Active Directory Sites and Services • Default-First-Site-Name Should be renamed • Create a site Assign to site link • Create a subnet Assign to site A site can have >1 subnet A subnet can be associated with only one site 4 Manage Domain Controllers in Sites • DCs should be in the correct site The SERVERS container will show only DCs, not all server • Add a DC to a site First DC will be in Default-First-Site-Name Additional DCs will be added to sites based on their subnet address DCPromo prompts you for the site You can right-click the Servers container of a site and pre-create the server object before promoting the DC • Move DC to a new site: right-click DC and choose Move • Delete a DC: right-click DC and choose Delete 5 Domain Controller Location: SRV Records • Domain controllers register service locator records (SRV) in DNS in the following locations _tcp.contoso.com: all DCs in the domain _tcp.siteName._sites.contoso.com: all DCs in site siteName • Clients query DNS for domain controllers 6 Domain Controller Location: Client New client queries for all DCs in the domain 1. Client queries for all DCs in the site 5. Retrieves SRVs from _tcp.domain Retrieves SRVs from _tcp.site._sites.domain 2. Attempts LDAP bind to all 6. Attempts LDAP bind to all 3. First DC to respond 7. First DC to respond 4. Examines client IP and subnet definitions Refers client to a site Client stores site in registry Authenticates client Client forms affinity Subsequently 8. Client binds to affinity DC DC offline? Client queries for DCs in registry-stored site Client moved to another site? DC refers client to another site 7 Review Active Directory Partitions Schema Forest Configuration Definitions and rules for creating and manipulating objects and attributes Information about the Active Directory structure Information about domainspecific objects Domain Domain • Full replica (DC) Active Directory Database • Read-only replica (RODC) Does not include secrets Replicates passwords per policy 8 Understand the Global Catalog Schema Configuration Domain A • Global catalog hosts a partial attribute set (PAS) for other domains in the forest • Supports queries for objects throughout the forest Schema Configuration Schema Domain A Configuration Domain B Domain B Global Catalog Server Schema Configuration Domain B 9 Place Global Catalog Servers • Recommendation: Every DC a GC • In particular If an application in a site queries the GC (port 3268) If a site contains an Exchange server If a connection to a GC in another site is slow/unreliable Schema Configuration Schema Configuration Domain A Domain A Make a GC? Domain B HEADQUARTERS Domain B BRANCHA 10 Configure a Global Catalog Server • Right-click the NTDS Settings node underneath the DC 11 Universal Group Membership Caching • Universal group membership replicated in the GC Normal logon: user’s token built with UGs from GC GC not available at logon: DC denies authentication • If every DC is a GC, this is never a problem • If connectivity to a GC is not reliable DCs can cache UG membership for a user when user logs on GC later not available: user authenticated with cached UGs • In sites with unreliable connectivity to GC: enable UGMC • Right-click NTDS Settings for site Properties Enables UGMC for all DCs in the site 12 Understand Application Directory Partitions • Support a specific application Schema Configuration Domain A Schema DNS • Targeted to specific DCs • Managed with the admin tool for the app: e.g. DNS Manager • Consider app partitions before demoting a DC Configuration Schema Domain A Configuration Domain B Domain B DNS Schema Configuration Domain B 13 Understand Active Directory Replication • Multimaster replication’s balancing act: “loose coupling” Accuracy (integrity) Consistency (convergence) Performance (keeping replication traffic to a reasonable level) • Key characteristics of Active Directory Replication Multimaster replication Pull replication Store-and-forward Partitions Automatic generation of an efficient & robust replication topology Attribute level replication Distinct control of intrasite and intersite replication Collision detection and remediation 14 Intrasite Replication • Connection object: inbound replication to a DC • Knowledge consistency checker (KCC) creates topology Efficient (maximum three hop) & robust (two-way) topology Runs automatically, but you can “Check Replication Topology” Few reasons to manually create connection objects • Standby operations masters should have connections to masters • Replication Notification: DC tells its downstream partners change is available (15 seconds) DC1 DC3 DC2 Polling: DC checks with its upstream partners (1 hour) for changes Downstream DC directory replication agent (DRA) replicates changes Changes to all partitions held by both DCs are replicated 15 Site Links • Intersite topology generator (ISTG) builds replication topology between sites • Site links Contain sites Within a site link, a connection object can be created between any two DCs Not always appropriate given your network topology! 16 Replication Transport Protocols • Directory Service Remote Procedure Call (DS-RPC) Appears as IP in Active Directory Sites and Services The default and preferred protocol for intersite replication • Inter-Site Messaging—Simple Mail Transport Protocol (ISM-SMTP) Appears as SMTP in Active Directory Sites and Services Rarely used in the real world Requires a certificate authority Cannot replicate the domain naming context—only schema and configuration Any site that uses SMTP to replicate must be in a separate domain within the forest 17 Bridgehead Servers • Replicates changes from bridgeheads in all other sites • Polled for changes by bridgeheads in all other sites • Selected automatically by ISTG • Or you can configure preferred bridgehead servers Firewall considerations Performance considerations 18 Site Link Transitivity and Bridges • Site link transitivity (default) ISTG can create connection objects between site links Disable transitivity in the properties of the IP transport • Site link bridges Manually transitive site links Useful only when transitivity is disabled 19 Control Intersite Replication • Site link costs Replication uses the connections with the lowest cost • Replication Notifications off by default. Bridgeheads do not notify partners Polling. Downstream bridgehead polls upstream partners • Default: 3 hours • Minimum: 15 minutes • Recommended: 15 minutes Replication schedules • 24 hours a day • Can be scheduled 300 100 20 Whiteboard: Replication RODC BH Branch IP Subnet Site D IP Subnet IP Subnet IP Subnet BH IP Subnet Site B Site Link Bridge BH Site A IP Subnet BH Site C IP Subnet 21 Monitor and Manage Replication • RepAdmin repadmin /showrepl hqdc01.contso.com repadmin /showconn hqdc01.contoso.com repadmin /showobjmeta hqdc01 "cn=Linda Miller,ou=…" repadmin /kcc repadmin /replicate hqdc02 hqdc01 dc=contoso,dc=com repadmin /syncall hqdc01.contoso.com /A /e • DCDiag /test:testName FrsEvent or DFSREvent Intersite KccEvent Replications Topology 22