Active Directory Sites and Services

Active Directory® Sites and Services is a Microsoft Management Console (MMC) snap-in in the Windows Server® 2008 R2 operating system that you can use to administer the replication of directory data among all sites in an Active Directory Domain Services (AD DS) forest. This snap-in also provides a view of the service-specific objects that are published in AD DS.

Note

You can also use Active Directory Sites and Services to administer the replication of directory data among all sites in an Active Directory Lightweight Directory Services (AD LDS) configuration set.

Administrators who are responsible for forest-wide service administration can use Active Directory Sites and Services to manage the intersite replication topology for the forest. Administrators who are responsible for application services can be delegated responsibility for the service containers into which application-specific objects are published.

When you add the Active Directory Domain Services server role to a server, Active Directory Sites and Services is added to the Administrative Tools menu.

  • Overview of Active Directory Sites and Services

  • Checklist: Configure an Additional Site

  • Checklist: Configure the Intersite Replication Schedule

  • Checklist: Add a Global Catalog Server

  • Adding a Site to the Forest

  • Scheduling Replication Between Sites

  • Adding the Global Catalog to a Site

  • Troubleshooting Active Directory Domain Services Replication

  • Resources for Active Directory Sites and Services

  • User Interface: Active Directory Sites and Services


Overview of Active Directory Sites and Services

You can use the Active Directory Sites and Services snap-in to manage the site-specific objects that implement the intersite replication topology. These objects are stored in the Sites container in Active Directory Domain Services (AD DS).

Note

You can also use Active Directory Sites and Services to administer the replication of directory data among all sites in an Active Directory Lightweight Directory Services (AD LDS) configuration set.

In addition, Active Directory Sites and Services provides a view of the Services container, which you can use to view service-related objects that are published in AD DS.

The following sections provide detailed information about site management and service publication with Active Directory Sites and Services:

  • Site management

  • Service publication

  • Additional references

Site management

In your physical network, a site represents a set of computers that are connected by a high-speed network, such as a local area network (LAN). Typically, all computers in the same physical site reside in the same building or perhaps the same campus network.

In AD DS, a site object represents the aspects of the physical site that you can manage, specifically, replication of directory data between domain controllers. You can use Active Directory Sites and Services to manage the objects that represent the sites and the servers that reside in those sites.

Site objects and their related objects are replicated to all domain controllers in an Active Directory forest. You can manage the following objects in Active Directory Sites and Services:

  • Sites

  • Subnets

  • Servers

  • NTDS Settings

  • Connections

  • Site links

  • IP and SMTP intersite transports

Sites

Site objects are located in the Sites container. You can use site objects to accomplish the following tasks:

  • Create new sites

  • Delegate control over sites by using Group Policy and permissions

In every site, there is an NTDS Site Settings object. This object identifies the intersite topology generator (ISTG). The ISTG is the one domain controller in the site that generates connection objects from domain controllers in different sites. It also performs advanced replication management tasks.

For more information about sites and the NTDS Site Settings object, see Understanding Sites, Subnets, and Site Links.

Subnets

Subnet objects identify the ranges of IP addresses within a site. You can use subnet objects to accomplish the following tasks:

  • Create new subnets

  • Associate subnets with sites

  • Provide a location for a site that can be used by the printer location tracking feature in Group Policy

For more information about subnets, see Understanding Sites, Subnets, and Site Links.

Servers

Server objects are created automatically when you add the Active Directory Domain Services server role. Servers represent domain controllers in the replication topology.

You can use server objects to accomplish the following tasks:

  • Identify domain controllers that will act as preferred bridgehead servers. You can use preferred bridgehead servers to control intersite replication so that it occurs only between those domain controllers that you specify and not between domain controllers that might be less able to handle intersite replication traffic.

  • Move servers between sites. If you create a new site and you have already installed domain controllers with IP addresses that map to the new site, you can move the domain controllers to the new site.

NTDS Settings

Every server object contains an NTDS Settings object, which represents the domain controller in the replication system. The NTDS Settings object stores connection objects, which make replication possible between two or more domain controllers.

You can use NTDS Settings objects to accomplish the following tasks:

  • Generate the replication topology. The Check Replication Topology command for the NTDS Settings object signals the ISTG to perform a check of all connections between domain controllers and add or remove any connections that are needed.

  • Enable or disable the global catalog on a server. When you enable the global catalog, the domain controller replicates the read-only directory partitions that make up the global catalog in the forest.

For more information about the global catalog, see Understanding the Global Catalog.

Connections

Replication partners of servers in a site are identified by connection objects. Replication occurs in one direction. A connection object for a server contains information about the other server (the "from" server) that sends replication to the first server. Connection objects store schedules that control replication within a site. By default, they automatically poll a replication partner for new changes once every hour. For intersite replication, connection objects derive their schedule from the site link object. You do not have to manage schedules on connection objects. Connection objects are created automatically by the replication system.

You can use connection objects to accomplish the following tasks:

  • Identify replication partnerships of servers in the site

  • Force replication over a connection, when you do not want to wait for scheduled replication or to test replication over a connection

Site links

Site links represent the flow of replication between sites. You can manage intersite replication by configuring site properties: over what time periods replication can occur, how often replication occurs within a certain time period, and the preferred routes between two sites.

You can use site link objects to accomplish the following tasks:

  • Add and remove sites that use the site link

  • Set the cost of replication over the site link, which determines the likelihood that replication occurs over this site link when there are multiple routes that replication could take to reach a destination site

  • Set the site link schedule, which determines the hours and days that replication is available (can occur) over the site link

  • Set the replication interval, which determines how often replication occurs over the site link when replication is available

For more information about using site links, see Scheduling Replication Between Sites.

IP and SMTP intersite transports

Replication uses remote procedure call (RPC) over either the IP transport or the Simple Mail Transfer Protocol (SMTP) transport. You can use SMTP to send replication within mail messages in environments where wide area network (WAN) links are not available. In this case, replication occurs according to the messaging schedule and not the site link schedule. By default, intersite replication uses the IP transport protocol to deliver replication packets. You can use the IP and SMTP Intersite Transport containers to accomplish the following tasks:

  • Create site links. You can add site links to the replication topology as needed to accommodate new sites.

  • Create site link bridges. Site links are bridged by default in AD DS, and they are not necessary in most deployments.

For more information about intersite transports, see Scheduling Replication Between Sites.

Service publication

Some services, such as Certificate Services, Message Queuing, and Exchange Server, publish information in the Sites container in AD DS automatically when they are installed. Other services can be published in the directory with programming interfaces.

Active Directory Sites and Services exposes published service-related objects in the Services node. This node is not visible by default. To view this node, open Active Directory Sites and Services, and then, on the View menu, click Show Services Node.

The objects in the Services node in Active Directory Sites and Services are published for use by the respective application administrators. For this reason, information about these objects is available in documentation for the service or application.

For more information about service publication in AD DS, see Service Publication (http://go.microsoft.com/fwlink/?LinkId=86230).

Additional references

  • Adding a Site to the Forest

  • Scheduling Replication Between Sites

  • Adding the Global Catalog to a Site


Checklist: Configure an Additional Site

The tasks for configuring a new site include the following:

  • Creating the site

  • Mapping the correct IP addresses to the site by creating a subnet

  • Linking the site to another site or sites by creating a site link and adding the new site to it

Task | Reference
(Optional) Review sites and replication concepts. | Understanding Sites, Subnets, and Site Links
Create a new site object to represent the domain controllers in a geographic location. | Create a Site
Identify the range of IP addresses that domain controllers in this site use—and that identify the domain controllers as members of this site—by creating a subnet object and associating it with the new site. | Create a Subnet
Create a site link object that connects the new site with an existing site so that replication can occur between the two sites. You can use the site link object to manage the replication schedule. | Create a Site Link
Change the site link association of the new site from its existing site link to the new site link so that replication will begin with the new site link. | Add a Site to or Remove a Site from a Site Link


Checklist: Configure the Intersite Replication Schedule

You can use site link objects to control the blocks of time during which replication can occur between sites that are connected by a site link. Within those blocks of time, you can also control how often replication partners request changes from their partners. After you configure a new site link, you can check whether replication between the sites is succeeding by forcing inbound replication over the connections of both replication partners.

Task | Reference
(Optional) Review intersite replication concepts. | Understanding Replication Between Sites Scheduling Replication Between Sites
Configure the times during which replication between sites is possible to ensure that intersite replication occurs only when network bandwidth is most available or a business scenario requires that directory data be the most current. | Configure Intersite Replication Availability
Configure how often intersite replication occurs between sites during the times that replication is available on a site link. | Configure Intersite Replication Frequency


Checklist: Add a Global Catalog Server

If you have more than one domain in your forest and you have a significant user population in a site, you can optimize the speed and efficiency of domain logons and directory searches by adding a global catalog server to the site.

If you have a single-domain forest, global catalog servers are not required for logons, but directory searches are directed to the global catalog. In this case, you can enable the global catalog on all domain controllers for faster directory searches.

Task | Reference
(Optional) Review global catalog concepts. | Understanding the Global Catalog
Add or remove the global catalog read-only directory partitions from a domain controller in the site. | Add or Remove the Global Catalog
Confirm that all read-only directory partitions have been replicated to the new global catalog server. | Verify Global Catalog Readiness
Verify that the global catalog server is being advertised in Domain Name System (DNS). | Verify Global Catalog DNS Registrations


Adding a Site to the Forest

If you want to deploy domain controllers in an area of your network that is remote from the hub site, you can create a site object in Active Directory Domain Services (AD DS) to represent the local area network (LAN) in the remote area. You must configure the site to include the subnet addresses that are assigned on the remote LAN. When you create a new site object, you must place the site into an existing site link. If you already have multiple sites, you may have to create an additional site link to connect the new site to an existing site.

After you create a new site, when you add the Active Directory Domain Services server role to a server that has an IP address that maps to that site, you can specify that the server object for the new domain controller is created in the site according to its IP address. As an alternative, you can select the site for the new domain controller and then configure its IP address to an address that maps to a subnet in that site.

Procedure requirements

The procedures in this section have the following requirements:

  • The network address or addresses (in the form network address/prefix). These addresses form the subnet object names when you create subnets.

  • A site link. To create a site, you must add the new site to an existing site link. You can use the default site link (DEFAULTIPSITELINK) if no other site link exists. If you have more than two existing sites and you are adding a site, you might add the site to an existing site link and then create a new site link and associate the new site with that site link. In most cases, you then remove the new site from the old site link.

  • The transport protocol that is available for replication over the site link. When a wide area network (WAN) link is available between the sites, use the IP transport. When connectivity is intermittent or when end-to-end IP connectivity is not available, you can use Simple Mail Transfer Protocol (SMTP) for replication to the site. However, SMTP replication has restrictions. For more information about using SMTP replication, see Understanding Replication Between Sites.

To add a site to a forest, perform the following procedures:

  • Create a Site

  • Create a Subnet

  • Create a Site Link

  • Add a Site to or Remove a Site from a Site Link

Additional references

  • Understanding Sites, Subnets, and Site Links


Understanding Sites, Subnets, and Site Links

An understanding of sites, subnets, and site links helps you effectively manage sites and their implementation in Active Directory Domain Services (AD DS).

Sites overview

Sites in AD DS represent the physical structure, or topology, of your network. AD DS uses network topology information, which is stored in the directory as site, subnet, and site link objects, to build the most efficient replication topology. The replication topology itself consists of the set of connection objects that enable inbound replication from a source domain controller to the destination domain controller that stores the connection object. The Knowledge Consistency Checker (KCC) creates these connection objects automatically on each domain controller.

Note

You do not have to manage connection objects. In fact, changes that you make to connection objects that the KCC creates automatically are ignored.

You can use the Active Directory Sites and Services snap-in to manage the site, subnet, and site link objects that combine to influence the replication topology.

Note

You can also use Active Directory Sites and Services to manage sites in an Active Directory Lightweight Directory Services (AD LDS) configuration set.

It is important to distinguish between sites and domains. Sites represent the physical structure of your network, while domains represent the logical structure of your organization. Site objects and their contents are replicated to all domain controllers in the forest, irrespective of domain or site.

Using sites

Domain controllers and other servers that use sites publish server objects in AD DS to take advantage of the good network connectivity that sites provide. You place domain controllers into sites according to where the domain data is needed. For example, if no users from a domain are physically located in a site, there is no reason to place a domain controller for that domain in the site.

Sites help facilitate several activities, including:

  • Replication. AD DS balances the need for up-to-date directory information with the need for bandwidth optimization by replicating information within a site whenever data is updated and between sites according to a configurable schedule.

  • Authentication. Site information helps make authentication faster and more efficient. When a client logs on to a domain, it first requests a domain controller in its local site for authentication. By establishing sites, you can ensure that clients use domain controllers that are nearest to them for authentication, which reduces authentication latency and traffic on wide area network (WAN) connections.

  • Service location. Other services, such as Active Directory Certificate Services (AD CS), Exchange Server, and Message Queuing, use AD DS to store objects that can use site and subnet information that make it possible for clients to locate the nearest service providers more easily.

Associating sites and subnets

A subnet object in AD DS groups neighboring computers in much the same way that postal codes group neighboring postal addresses. By associating a site with one or more subnets, you assign a set of IP addresses to the site.

Note

The term "subnet" in AD DS does not have the strict networking definition of the set of all addresses behind a single router. The only requirement for an AD DS subnet is that the address prefix conforms to the IP version 4 (IPv4) or IP version 6 (IPv6) format.

When you add the Active Directory Domain Services server role to create the first domain controller in a forest, a default site (Default-First-Site-Name) is created in AD DS. As long as this site is the only site in the directory, all domain controllers that you add to the forest are assigned to this site. However, if your forest will have multiple sites, you must create subnets that assign IP addresses to Default-First-Site-Name as well as to all additional sites.

Assigning computers to sites

Server objects are created in AD DS by applications or services, and they are placed into a site based on their IP address. When you add the Active Directory Domain Services server role to a server, a server object is created in the AD DS site that contains the subnet to which the server's IP address maps. If the domain controller's IP address does not map to any site in the forest, the domain controller's server object is created in the site of the domain controller that provides the replication source for AD DS.

Note

Server objects are not created in Default-First-Site-Name by default unless there are no other sites in the forest.

For a client, site assignment is determined dynamically by its IP address and subnet mask during logon.

Locating domain controllers by site

Domain controllers register service (SRV) resource records in Domain Name System (DNS) that identify their site names. Domain controllers also register host (A) resource records in DNS that identify their IP addresses. When a client requests a domain controller, it provides its site name to DNS. DNS uses the site name to locate a domain controller in that site (or in the next closest site to the client). DNS then provides the IP address of the domain controller to the client for the purpose of connecting to the domain controller. For this reason, it is important to ensure that the IP address that you assign to a domain controller maps to a subnet that is associated with the site of the respective server object. Otherwise, when a client requests a domain controller, the IP address that is returned might be the IP address of a domain controller in a distant site. When a client connects to a distant site, the result can be slow performance and unnecessary traffic on expensive WAN links.

Connecting sites with site links

Networks usually consist of a set of local area networks (LANs) that are connected by WANs. In AD DS, site link objects represent the WAN connections between sites. Whereas replication within a site is triggered automatically when a directory update occurs, replication between sites (over slower, more expensive WAN links) is scheduled to occur every 3 hours. You can change the default schedule to occur during the periods that you specify, and at the intervals that you specify, so that you can control WAN link traffic.

Additional references

  • Understanding Replication Between Sites

  • Adding a Site to the Forest


Create a Site

You can use the Active Directory Sites and Services snap-in to create new sites in your environment.

Membership in the Enterprise Admins group in the forest or the Domain Admins group in the forest root domain, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To create a site

  1. Open Active Directory Sites and Services. To open Active Directory Sites and Services, click Start, click Administrative Tools, and then click Active Directory Sites and Services.

  2. In the console tree, right-click Sites, and then click New Site.

  3. In Name, type the name of the new site.

  4. In Link Name, click a site link object, and then click OK.

Additional considerations

  • To perform this procedure, you must be a member of the Enterprise Admins group in the forest or the Domain Admins group in the forest root domain, or you must have been delegated the appropriate authority. As a security best practice, use Run as administrator to perform this procedure. Log on with your lowest-level user account and use administrative credentials when you manage Active Directory Domain Services (AD DS).

Additional references

  • Adding a Site to the Forest


Create a Subnet

You can use the Active Directory Sites and Services snap-in to create new subnets.

Membership in the Enterprise Admins group in the forest or the Domain Admins group in the forest root domain, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To create a subnet

  1. Open Active Directory Sites and Services. To open Active Directory Sites and Services, click Start, click Administrative Tools, and then click Active Directory Sites and Services.

  2. In the console tree, double-click Sites, right-click Subnets, and then click New Subnet.

  3. In Prefix, type the IP version 4 (IPv4) or IP version 6 (IPv6) subnet prefix.

  4. In Select a site object for this prefix, click the site to associate with this subnet, and then click OK.

Additional considerations

  • To perform this procedure, you must be a member of the Enterprise Admins group in the forest or the Domain Admins group in the forest root domain, or you must have been delegated the appropriate authority. As a security best practice, use Run as administrator to perform this procedure. Log on with your lowest-level user account and use administrative credentials when you manage Active Directory Domain Services (AD DS).

Additional references

  • Adding a Site to the Forest


Create a Site Link

You can use the Active Directory Sites and Services snap-in to create new site links.

Membership in the Enterprise Admins group in the forest or the Domain Admins group in the forest root domain, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To create a site link

  1. Open Active Directory Sites and Services. To open Active Directory Sites and Services, click Start, click Administrative Tools, and then click Active Directory Sites and Services.

  2. In the console tree, right-click the intersite transport protocol that you want the site link to use.

    Where?

    • Active Directory Sites and Services\Sites\Inter-Site Transports\IP or SMTP

  3. Click New Site Link.

  4. In Name, type the name for the site link.

  5. In Sites not in this site link, click a site to add to the site link, and then click Add. Repeat to add more sites to the site link. To remove a site from the site link, in Sites in this link, click the site, and then click Remove.

  6. When you have added the sites that you want to be connected by this site link, click OK.
Important

Use the IP intersite transport unless your network has remote sites where network connectivity is intermittent or end-to-end IP connectivity is not available. Simple Mail Transfer Protocol (SMTP) replication has restrictions that do not apply to IP replication. For more information about using the SMTP transport, see Understanding Replication Between Sites.

Additional considerations

  • To perform this procedure, you must be a member of the Enterprise Admins group in the forest or the Domain Admins group in the forest root domain, or you must have been delegated the appropriate authority. As a security best practice, use Run as administrator to perform this procedure. Log on with your lowest-level user account and use administrative credentials when you manage Active Directory Domain Services (AD DS).

Additional references

  • Adding a Site to the Forest


Add a Site to or Remove a Site from a Site Link

When you add sites and site links to your forest, you might create a condition in which the same site is added to two site links. You also might create a condition in which a site link does not contain all the sites for which replication is required over the site link. You can use the Active Directory Sites and Services snap-in to add sites to site links and to remove sites from site links.

Membership in the Enterprise Admins group in the forest or the Domain Admins group in the forest root domain, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To add a site to or remove a site from a site link

  1. Open Active Directory Sites and Services. To open Active Directory Sites and Services, click Start, click Administrative Tools, and then click Active Directory Sites and Services.

  2. In the console tree, click the intersite transport folder that contains the site link in which you are adding or removing a site.

    Where?

    • Active Directory Sites and Services\Sites\Inter-Site Transports\IP or SMTP

  3. In the details pane, right-click the site link in which you want to add or remove a site, and then click Properties.

  4. In the appropriate list, click the site that you want to add to or remove from this site link, and then click Add or Remove, respectively.
Important

Use the IP intersite transport unless your network has remote sites where network connectivity is intermittent or end-to-end IP connectivity is not available. Simple Mail Transfer Protocol (SMTP) replication has restrictions that do not apply to IP replication. For more information about using the SMTP transport, see Understanding Replication Between Sites.

Additional considerations

  • To perform this procedure, you must be a member of the Enterprise Admins group in the forest or the Domain Admins group in the forest root domain, or you must have been delegated the appropriate authority. As a security best practice, use Run as administrator to perform this procedure. Log on with your lowest-level user account and use administrative credentials when you manage Active Directory Domain Services (AD DS).

Additional references

  • Adding a Site to the Forest


Scheduling Replication Between Sites

To control replication between two sites, you can use the Active Directory Sites and Services snap-in to configure settings on the site link object to which the sites are added. By configuring settings on a site link, you can control when replication occurs between two or more sites, and how often. When you configure settings on a site link, consider the network traffic that is generated by your line of business applications, the hours of business operations, and the peak activity periods during the workday. Weigh these considerations against the need for directory updates in your remote sites. You might decide, for example, that replication once a day—after hours during a low-traffic time period—is sufficient for users in your remote sites to perform their duties.

Procedure requirements

The procedures in this section have the following requirements:

  • A site link object that represents a physical wide area network (WAN) link between two or more sites

  • Information about the WAN traffic between the sites and the update requirements of users and applications in the remote sites

To schedule replication between sites, perform the following procedures:

  • Configure Intersite Replication Availability

  • Configure Intersite Replication Frequency

Additional references

  • Understanding Replication Between Sites


Understanding Replication Between Sites

Active Directory Domain Services (AD DS) handles replication between sites, or intersite replication, differently than replication within sites because bandwidth between sites is usually limited. The Active Directory Knowledge Consistency Checker (KCC) builds the intersite replication topology using a least-cost spanning tree design. Intersite replication is optimized for bandwidth efficiency. Directory updates between sites occur automatically based on a configurable schedule. Directory updates that are replicated between sites are compressed to preserve bandwidth.

Building the intersite replication topology

AD DS uses information that you provide (through the Active Directory Sites and Services snap-in) about your sites and site links to build the most efficient intersite replication topology automatically. The directory stores the replication topology as connection objects, which the system creates automatically to form the replication topology both within sites and between sites. Connection objects identify replication partners for both intrasite replication and intersite replication. These objects always represent one-way, inbound replication to the server that contains the object. The intersite replication topology is updated regularly to respond to any changes that occur in the network. You do not have to create or manage connection objects. However, you can control the timing of intersite replication through the information that you provide when you configure site link objects.

Note

You can use Active Directory Sites and Services to administer the replication of directory data among all the sites in an Active Directory Lightweight Directory Services (AD LDS) configuration set.

Determining when intersite replication occurs

AD DS preserves bandwidth between sites by minimizing the frequency of replication and by making it possible for you to schedule the availability of site links for replication. By default, intersite replication across each site link occurs every 180 minutes (3 hours). You can adjust this frequency to match your specific needs. Be aware that increasing this frequency increases the amount of bandwidth that replication uses. In addition to scheduling the frequency of replication, you can also schedule the availability of site links for replication. By default, a site link is available to carry replication traffic 24 hours a day, 7 days a week. You can limit this schedule to specific days of the week and times of day. For example, you can schedule intersite replication so that it occurs only after normal business hours, five days a week.

If you have multiple site links configured so that there is more than one route between two sites, you can configure the cost of replication on the site link to identify a preference for one route over the other. For more information about how cost affects intersite replication routes, see How Active Directory Replication Topology Works (http://go.microsoft.com/fwlink/?LinkId=93526). For more information about configuring site link cost, see Administering Intersite Replication (http://go.microsoft.com/fwlink/?LinkId=93527).

Using replication transports

The default transport for AD DS replication within sites is Remote Procedure Call (RPC) over IP. RPC over IP is also used for intersite replication. The IP container in Active Directory Sites and Services contains objects that represent site links that use RPC over IP to package and transfer replication data between sites. To keep data secure while it is in transit between sites, RPC over IP replication uses both authentication (with the Kerberos version 5 (V5) authentication protocol) and data encryption.

When a direct or reliable IP connection is not available, you can configure replication between sites to use Simple Mail Transfer Protocol (SMTP). However, SMTP replication functionality is limited to nondomain replication (schema, configuration, and global catalog updates). It also requires an enterprise certification authority (CA) when you use it over site links. In Windows Server 2008 R2, the SMTP component of Intersite Messaging is optional. You must add it before you can use SMTP for replication. For more information about SMTP replication, see How Active Directory Replication Topology Works (http://go.microsoft.com/fwlink/?LinkId=93526).

Note

Intersite replication through a firewall or a virtual private network (VPN) requires some special considerations. For more information, see Active Directory in Networks Segmented by Firewalls (http://go.microsoft.com/fwlink?linkid=45087).

Additional references

  • Understanding Sites, Subnets, and Site Links

  • Scheduling Replication Between Sites


Configure Intersite Replication Availability

To control the blocks of time during which intersite replication can occur over a site link, you can use the Active Directory Sites and Services snap-in to configure the availability settings in the site link schedule.

Membership in the Enterprise Admins group in the forest or the Domain Admins group in the forest root domain, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure intersite replication availability

  1. Open Active Directory Sites and Services. To open Active Directory Sites and Services, click Start, click Administrative Tools, and then click Active Directory Sites and Services.

  2. In the console tree, click the intersite transport folder that contains the site link for which you are configuring intersite replication availability.

    Where?

    • Active Directory Sites and Services\Sites\Inter-Site Transports\IP or SMTP

  3. In the details pane, right-click the site link whose schedule you want to configure, and then click Properties.

  4. Click Change Schedule.

    Note

    When you are logged on with an account that does not have sufficient credentials to change the schedule, the available option is View Schedule.

  5. Select the block of time during which you want replication to be either available or not available, and then click Replication Not Available or Replication Available, respectively.
Important

Use the IP intersite transport unless your network has remote sites where network connectivity is intermittent or end-to-end IP connectivity is not available. Simple Mail Transfer Protocol (SMTP) replication has restrictions that do not apply to IP replication. For more information about using the SMTP transport, see Understanding Replication Between Sites.

Additional considerations

  • To perform this procedure, you must be a member of the Enterprise Admins group in the forest or the Domain Admins group in the forest root domain, or you must have been delegated the appropriate authority. As a security best practice, use Run as administrator to perform this procedure. Log on with your lowest-level user account and use administrative credentials when you manage Active Directory Domain Services (AD DS).

Additional references

  • Scheduling Replication Between Sites


Configure Intersite Replication Frequency

To specify how often replication can occur during any block of availability in the intersite replication schedule, you can use the Active Directory Sites and Services snap-in to configure the frequency setting in the site link object properties. At the specified interval (for example, once every 60 minutes), a domain controller that is acting as a bridgehead server in a site requests changes from its source replication partner in a different site.

Membership in the Enterprise Admins group in the forest or the Domain Admins group in the forest root domain, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure intersite replication frequency

  1. Open Active Directory Sites and Services. To open Active Directory Sites and Services, click Start, click Administrative Tools, and then click Active Directory Sites and Services.

  2. In the console tree, click the intersite transport folder that contains the site link for which you are configuring intersite replication availability.

    Where?

    • Active Directory Sites and Services\Sites\Inter-Site Transports\IP or SMTP

  3. In the details pane, right-click the site link whose schedule you want to configure, and then click Properties.

  4. In Replicate every, type or select the number of minutes between replications.
Important

Use the IP intersite transport unless your network has remote sites where network connectivity is intermittent or end-to-end IP connectivity is not available. Simple Mail Transfer Protocol (SMTP) replication has restrictions that do not apply to IP replication. For more information about using the SMTP transport, see Understanding Replication Between Sites.

Additional considerations

  • To perform this procedure, you must be a member of the Domain Admins group in the forest root domain or the Enterprise Admins group in the forest , or you must have been delegated the appropriate authority. As a security best practice, use Run as administrator to perform this procedure. Log on with your lowest-level user account and use administrative credentials when you manage Active Directory Domain Services (AD DS).

  • The default site link replication frequency is 180 minutes.

  • The Replicate every value will be processed as the nearest multiple of 15 minutes, ranging from a minimum of 15 minutes to a maximum of 10,080 minutes (1 week).

Additional references

  • Scheduling Replication Between Sites


Adding the Global Catalog to a Site

A global catalog server makes it possible to search the entire Active Directory Domain Services (AD DS) forest without referrals to a domain controller in the domain that stores the target of the search. When you add the global catalog to a domain controller, a partial, read-only replica of every domain in the forest (other than the domain that the new global catalog server stores) is replicated to the domain controller. Global catalog servers are required for searching and for processing domain logons in forests where universal groups are available.

Global catalog servers and domains

Global catalog servers respond to forest-wide Lightweight Directory Access Protocol (LDAP) queries over port 3268. The global catalog eliminates the need for a query to be sent to multiple domain controllers until the query locates the domain that contains the requested object.

When a forest contains only one domain, all domain controllers have the full complement of objects that can be searched, and a global catalog server is not required to eliminate referrals to other domains. However, because the global catalog port is different from the default LDAP port (389), global catalog queries must locate a global catalog server. In a single-domain forest, by configuring all domain controllers as global catalog servers you ensure that global catalog queries are load-balanced evenly among all domain controllers in the domain. Because no additional replication or processing of other domain data is required, the single-domain global catalog server requires no special hardware advantages over other domain controllers.

If a forest contains more than one domain, however, a global catalog server must store and replicate domain data for all domains in the forest. In this case, determine the placement of global catalog servers in your forest according to site needs, as described in the following section.

Global catalog servers and sites

To optimize network performance in a multiple-site environment, consider adding global catalog servers in sites according to the needs in the sites for fast search responses and domain logons. In a single-site, multiple-domain environment, a single global catalog server is usually sufficient to cover common Active Directory queries and logons. Use the information in the following table to determine whether your multiple-domain, multiple-site environment can benefit from additional global catalog servers.

Use a global catalog when … Advantage Disadvantage

A commonly used application in the site uses port 3268 to resolve global catalog queries.

Performance improvement

Additional network traffic due to global catalog replication

A slow or unreliable wide area network (WAN) connection is used to connect to other sites. Use the same failure rules and load distribution rules that you use for individual domain controllers to determine whether additional global catalog servers are necessary in each site.

Fault tolerance

Additional network traffic due to global catalog replication

Users in the site belong to a Windows 2000 domain with the domain functional level set to Windows 2000 native. In this case, all users must obtain universal group membership information from a global catalog server. If a global catalog server is not located in the same site, all logon requests must be routed over a WAN connection to a global catalog server in another site.

You can use universal group membership caching, a feature that is available on domain controllers running Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 to eliminate the need to contact a global catalog server in a different site during domain logons.

Fast user logons

Additional network traffic due to global catalog replication

Additional references

  • Understanding the Global Catalog

  • Add or Remove the Global Catalog

  • Verify Global Catalog Readiness

  • Verify Global Catalog DNS Registrations


Understanding the Global Catalog

The global catalog is the set of all objects in an Active Directory Domain Services (AD DS) forest. A global catalog server is a domain controller that stores a full copy of all objects in the directory for its host domain and a partial, read-only copy of all objects for all other domains in the forest. Global catalog servers respond to global catalog queries.

Attributes that replicate to the global catalog

The partial, read-only copies of objects that make up the global catalog are described as "partial" because they include a limited set of attributes—the attributes that are required by the schema plus the attributes that are most commonly used in user search operations. These attributes are marked for inclusion in the partial attribute set (PAS) as part of their schema definitions. Storing the most commonly searched attributes of all domain objects in the global catalog makes searches more efficient for users without affecting network performance with unnecessary referrals to domain controllers and without requiring a global catalog server to store large amounts of data that is not needed.

Global catalog functionality

When you install AD DS, the global catalog for a new forest is created automatically on the first domain controller in the forest. You can add global catalog functionality to additional domain controllers. You can also remove the global catalog from a domain controller.

A global catalog server:

  • Finds objects.

    The global catalog enables user searches for directory information throughout all domains in a forest, regardless of where the data is stored. Searches within a forest are performed with maximum speed and minimum network traffic.

    When a user searches for people or printers from the Start menu or selects the Entire Directory option in a query, that user is searching the global catalog. After the user enters a search request, the request is routed to the default global catalog port 3268 and sent to a global catalog server for resolution.

  • Supplies user principal name authentication.

    A global catalog server resolves a user principal name (UPN) when the authenticating domain controller has no knowledge of the user account. For example, if a user’s account is located in sales1.cohovineyard.com and the user logs on with a UPN of luis@sales1.cohovineyard.com from a computer that is located in sales2.cohovineyard.com, the domain controller in sales2.cohovineyard.com cannot find the user’s account and it must contact a global catalog server to complete the logon process.

  • Validates object references within a forest.

    Domain controllers use the global catalog to validate references to objects of other domains in the forest. When a domain controller holds a directory object with an attribute that contains a reference to an object in another domain, the domain controller validates the reference by contacting a global catalog server.

  • Supplies universal group membership information in a multiple-domain environment.

    A domain controller can always discover domain local group and global group memberships for any user in its domain, and the membership of these groups is not replicated to the global catalog. In a single-domain forest, a domain controller can also always discover universal group memberships. However, universal groups can have members in different domains. For this reason, the member attribute of universal groups, which contains the list of members in the group, is replicated to the global catalog. When a user in a multiple-domain forest logs on to a domain where universal groups are allowed, the domain controller must contact a global catalog server to retrieve any universal group memberships that the user might have in other domains.

    If a global catalog server is not available when a user logs on to a domain where universal groups are available, the user's client computer can use cached credentials to log on if the user has logged on to the domain previously. If the user has not logged on to the domain previously, the user can log on only to the local computer.

    Note

    The Administrator in the domain (the Builtin Administrator account) can always log on to the domain, even when a global catalog server is not available.

Universal group membership caching

On domain controllers running Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 in a site that has no global catalog server, you can use universal group membership caching to reduce the need to contact a global catalog server in a different site. When this feature is enabled, the first time that a user logs on to a domain where universal groups are available, the user's universal group membership information is cached on the domain controller. Thereafter, the domain controller uses cached memberships to process the logon, rather than having to contact a global catalog server.

Additional references

  • Adding the Global Catalog to a Site

  • Add or Remove the Global Catalog


Add or Remove the Global Catalog

You can use the same user interface (UI) in the Active Directory Sites and Services snap-in to add or remove the global catalog. Enabling the global catalog can cause additional replication traffic. However, global catalog removal occurs gradually in the background and does not affect replication or performance.

Membership in the Enterprise Admins group in the forest or the Domain Admins group in the forest root domain, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To add or remove the global catalog

  1. Open Active Directory Sites and Services. To open Active Directory Sites and Services, click Start, click Administrative Tools, and then click Active Directory Sites and Services.

  2. In the console tree, click the server object to which you want to add the global catalog or from which you want to remove the global catalog.

    Where?

    • Active Directory Sites and Services\Sites\SiteName\Servers

  3. In the details pane, right-click NTDS Settings of the selected server object, and then click Properties.

  4. Select the Global Catalog check box to add the global catalog, or clear the check box to remove the global catalog.

Additional considerations

  • To perform this procedure, you must be a member of the Domain Admins group in the domain of the selected domain controller or the Enterprise Admins group in the forest, or you must have been delegated the appropriate authority. As a security best practice, use Run as administrator to perform this procedure. Log on with your lowest-level user account and use administrative credentials when you manage Active Directory Domain Services (AD DS).

  • The domain controller does not advertise itself in Domain Name System (DNS) as a global catalog server until all partial domain directory partitions have been received.

  • You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell™. To open the Active Directory module, click Start, click Administrative Tools, and then click Active Directory Module for Windows PowerShell. For more information, see Add or Remove the Global Catalog (http://go.microsoft.com/fwlink/?LinkId=138333). For more information about Windows PowerShell, see Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372).

Additional references

  • Adding the Global Catalog to a Site


Verify Global Catalog Readiness

When a global catalog server satisfies replication requirements, the isGlobalCatalogReady rootDSE attribute is set to TRUE and the global catalog is ready to serve client computers. You can use the following procedures in the Ldp snap-in or at a command line to verify this setting.

Membership in the Enterprise Admins group in the forest or the Domain Admins group in the forest root domain, or equivalent, is the minimum required to complete these procedures. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Verifying global catalog readiness

  • Using the Windows interface

  • Using a command prompt
To verify global catalog readiness using the Windows interface

  1. Open the Ldp snap-in. To open Ldp, click Start, click Run, type ldp, and then click OK.

  2. On the Connection menu, click Connect.

  3. In Connect, type the name of the server whose global catalog readiness you want to verify.

  4. In Port, if 389 does not appear, type 389.

  5. If the Connectionless check box is selected, clear it, and then click OK.

  6. In the details pane, verify that the isGlobalCatalogReady attribute has a value of TRUE.

  7. On the Connection menu, click Disconnect, and then close Ldp.

Additional considerations

  • To perform this procedure, you must be a member of the Domain Admins group in the domain of the selected domain controller or the Enterprise Admins group in the forest, or you must have been delegated the appropriate authority. As a security best practice, use Run as administrator to perform this procedure. Log on with your lowest-level user account and use administrative credentials when you manage Active Directory Domain Services (AD DS).

Additional references

  • Adding the Global Catalog to a Site

  • Ldp Overview (http://go.microsoft.com/fwlink/?LinkId=93561)

To verify global catalog readiness using a command line

  1. Open a command prompt. To open a command prompt, click Start, click Run, type cmd, and then click OK.

  2. Type the following command, and then press ENTER:

    nltest /server:<servername> /dsgetdc:<domainname>

    Value Description

    nltest

    Performs network administrative tasks.

    /server:<servername>

    Specifies the name of the domain controller that you have designated as a global catalog server.

    /dsgetsdc:<domainname>

    Specifies the name of the domain to which the server belongs.

    In the Flags line of the output, if GC appears, the global catalog server has satisfied its replication requirements.

To view the complete syntax for this command, at a command prompt, type:

nltest /?

Additional considerations

  • To perform this procedure, you must be a member of the Domain Admins group in the domain of the selected domain controller or the Enterprise Admins group in the forest, or you must have been delegated the appropriate authority. As a security best practice, use Run as administrator to perform this procedure. Log on with your lowest-level user account and use administrative credentials when you manage AD DS.

Additional references

  • Adding the Global Catalog to a Site

  • Nltest Overview (http://go.microsoft.com/fwlink/?LinkId=93567)


Verify Global Catalog DNS Registrations

To verify that a server is advertised as a global catalog server, you can use the DNS Manager snap-in to verify the presence of Domain Name System (DNS) service location (SRV) resource records for the global catalog server.

Membership in the Enterprise Admins group in the forest or the Domain Admins group in the forest root domain, or equivalent, is the minimum required to complete these procedures. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To verify global catalog DNS registrations

  1. Restart the global catalog server whose DNS registrations you want to verify.

  2. Open DNS Manager. To open DNS Manager, click Start, click Administrative Tools, and then click DNS.

  3. To connect to a domain controller in the forest root domain for which you want to verify DNS registrations, right-click DNS, and then click Connect to DNS Server.

  4. In the console tree, click the _tcp container for the forest root domain.

    Where?

    • DNS\DNSServer\Forward Lookup Zones\ForestRootDomain\

  5. In the details pane, in the Name column, look for _gc, and in the Data column, look for the name of the server. The records that begin with _gc are global catalog service location (SRV) resource records.

Additional considerations

  • To perform this procedure, you must be a member of the Domain Admins group in the domain of the selected domain controller or the Enterprise Admins group in the forest, or you must have been delegated the appropriate authority. As a security best practice, use Run as administrator to perform this procedure. Log on with your lowest-level user account and use administrative credentials when you manage Active Directory Domain Services (AD DS).

Additional references

  • Adding the Global Catalog to a Site


Troubleshooting Active Directory Domain Services Replication

What problem are you having?

  • I need to find replication problems.

  • Replication between sites is slow.

I need to find replication problems.

  • Cause: Monitor replication regularly to help identify and fix problems before they grow.

  • Solution: Regular monitoring is the key to good replication maintenance. You can use Repadmin.exe, Dcdiag.exe, and the Directory Service event log (in Event Viewer) as your primary tools for monitoring replication.

    Repadmin is a command-line tool that reports failures between two replication partners. The following repadmin example displays the replication partners and any replication failures for Server1 in the adatum.com domain:

    repadmin /showrepl server1.adatum.com

    For a complete list of repadmin options, use the ? option:

    repadmin /?

    Dcdiag is a command-line tool that can check the Domain Name System (DNS) registration of a domain controller, verify that the security identifiers (SIDs) on the naming context heads have appropriate permissions for replication, analyze the state of domain controllers in a forest or enterprise, and more. The following dcdiag example checks for any replication errors between domain controllers:

    dcdiag /test:replications

    For a complete list of dcdiag options, use the ? option:

    dcdiag /?

    The Directory Service log (in Event Viewer under Application Logs) reports replication errors that occur after a replication link has been established.

Replication between sites is slow.

  • Cause: The time that is required to replicate directory data between domain controllers is known as the replication latency. Replication latency can vary greatly, depending on the number of domain controllers, the number of sites, the available bandwidth between sites, replication frequency, and more.

  • Solution:

    • Monitoring replication regularly is a good way to determine the normal replication latency on your network. With this knowledge, you can more easily determine if a problem is occurring.

    • Review the Directory Service log for any recent replication errors. Also, run the repadmin /showrepl command, and review any resulting errors.

    • A good site topology design is important for replication efficiency. For information about site topology design guidelines, see Designing the Site Topology for Windows Server 2008 AD DS (http://go.microsoft.com/fwlink/?LinkID=93576).


Resources for Active Directory Sites and Services

For more information about Active Directory Sites and Services, see the following resources on the Microsoft Web site:

  • For information about managing Active Directory Domain Services (AD DS) replication, see Administering Intersite Replication (http://go.microsoft.com/fwlink/?LinkId=93527).

  • For information about managing replication where firewalls are deployed, see Active Directory in Networks Segmented by Firewalls (http://go.microsoft.com/fwlink?linkid=45087).

  • For technical background information about replication topology, see Active Directory Replication Topology Technical Reference (http://go.microsoft.com/fwlink/?LinkId=93578).

  • For information about managing the global catalog, see Administering the Global Catalog (http://go.microsoft.com/fwlink/?LinkId=93580).

  • For technical background information about the global catalog, see Global Catalog Technical Reference (http://go.microsoft.com/fwlink/?LinkId=93581).

  • For information about troubleshooting AD DS replication, see Troubleshooting Active Directory Replication Problems (http://go.microsoft.com/fwlink/?LinkId=92818).

  • For information about Lightweight Directory Access Protocol (LDAP) query policy, see article 315071 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=65383).


User Interface: Active Directory Sites and Services

  • <SiteLinkName> Properties Sheet - General Tab

  • <ConnectionObjectName> Properties Sheet - General Tab

  • NTDS Settings Properties Sheet - General Tab

  • NTDS Site Settings Properties Sheet - Site Settings Tab

  • <ServerName> Properties Sheet - General Tab

  • IP or SMTP Properties - General Tab

  • New Object - Subnet Dialog Box

  • New Object - Site Link Bridge Dialog Box

  • Entering Address Prefixes


<SiteLinkName> Properties Sheet - General Tab

Item Details

Cost

Specifies a cost value to set the preference for using this site link instead of another site link that is capable of routing replication to the same site.

When more than one route is available between two sites, intersite replication occurs on the route with the least cost. If a domain controller is not available at the time that the replication topology is created, which makes replication through that site impossible, the next least-cost route is used. This rerouting is automatic when site links are bridged (transitive), which is the default setting.

Replicate every ___ minutes

Specifies the duration, in minutes, between replication events over this site link. Replication occurs with this frequency during times when replication over this site link is scheduled to be available.

The smallest replication interval is 15 minutes.

Change Schedule or View Schedule

To check or change this link's schedule, click Change Schedule.

When you are logged on with an account that does not have sufficient credentials to change the schedule, the available option is View Schedule.

Additional references

  • User Interface: Active Directory Sites and Services


<ConnectionObjectName> Properties Sheet - General Tab

Changes to connection object properties have no effect unless you own the connection object. You establish ownership of a connection object when you create a connection object manually or take ownership of an automatic connection object. You do not have to manage connection objects unless you are creating a replication topology manually.

Item Details

Transport

Provides the list of available network protocols for this connection to use.

Use IP for most replication scenarios. Simple Mail Transfer Protocol (SMTP) is available only for uncommon topologies that are not capable of IP replication.

Change Schedule or View Schedule

This schedule applies to intrasite connection objects and manually created intersite connection objects.

For a manually created intersite connection object, click to view or specify how often replication occurs over this connection. Automatically generated intersite connection objects derive their schedule from the site link object.

For an intrasite connection object, replication occurs in response to changes. However, automatically generated intrasite connection objects also have a default schedule of 1 hour to ensure that replication occurs if notification mechanisms fail. Automatically generated intrasite connection objects derive their schedule from the NTDS Site Settings object schedule.

Change

Click to select an alternative domain controller as the source replication partner from which directory information is replicated over this connection.

Replicated Naming Context(s)

The directory partitions that this domain controller has in common with its source replication partner in Server and for which this domain controller receives updates.

Partially Replicated Naming Context(s)

If this server is a global catalog server, updates to these read-only directory partitions are replicated over this connection.

Additional references

  • User Interface: Active Directory Sites and Services


NTDS Settings Properties Sheet - General Tab

Item | Details
Query Policy | Provides operational limits for a number of Lightweight Directory Access Protocol (LDAP) operations to ensure that domain controllers can support service-level guarantees.
DNS Alias | Displays the name of the alias (CNAME) resource record in Domain Name System (DNS) that replication partners use to locate domain controllers for replication. The alias (CNAME) resource record uses the globally unique identifier (GUID) of the directory system agent (also known as DSA) object.
Global Catalog check box | When you select this check box, the global catalog is added to this domain controller. When you clear this check box, the global catalog is removed from this domain controller. Because global catalog servers are required to check group membership during the logon process, adding the global catalog to a domain controller in each site reduces intersite traffic that is caused by logons.

Additional references

  • User Interface: Active Directory Sites and Services


NTDS Site Settings Properties Sheet - Site Settings Tab

Item Details

Change Schedule or View Schedule

The default schedule for intrasite replication. You should not change this schedule. Although intrasite replication occurs automatically when an update occurs, replication partners are also contacted once every hour to ensure that changes that might have been missed are replicated.

When you are logged on with an account that does not have sufficient credentials to change the schedule, the available option is View Schedule.

Intersite Topology Generator

The name of the single domain controller in the site that is responsible for creating connections from domain controllers in other sites. The combination of all the connections that are created by Intersite Topology Generators in all sites forms the intersite replication topology for the forest.

Universal Group Membership Caching

Enable Universal Group Membership Caching: Eliminates the need for a domain controller in this site to contact a global catalog server in a different site to check for universal group memberships during domain logons.

Refresh cache from: Lists the available sites in the forest. Use this list to specify a site from which to cache universal group memberships. <Default> uses the most efficient route to a site that has a global catalog server. If you specify a site, make sure that it contains a working global catalog server.

Additional references

  • User Interface: Active Directory Sites and Services


<ServerName> Properties Sheet - General Tab

Item Details

Transports available for inter-site data transfer

Lists the replication transports that this server can use for replication.

  • IP: The IP transport is the default replication transport for intrasite and intersite replication.

  • SMTP: The Simple Mail Transfer Protocol (SMTP) transport uses e-mail messages to transfer replication data. This transport requires additional configuration in your network properties, and it has significant limitations.

This server is a preferred bridgehead server for the following transports

Contains the transports that you have added to designate this server as a preferred bridgehead server. By adding a transport to the list, you designate the server as a preferred bridgehead server for replication that uses that transport. By removing a transport, you return the server to non–bridgehead–server status.

Additional references

  • User Interface: Active Directory Sites and Services


IP or SMTP Properties - General Tab

Item Details

Ignore schedules

This option is equivalent to replication being always available. If Ignore schedules is selected, replication occurs at the designated intervals but it ignores any scheduled days and hours. Site links that use the Simple Mail Transfer Protocol (SMTP) transport always ignore site link schedules.

Bridge all site links

Specifies whether replication can occur transitively between sites that are not connected directly by a site link. This option is enabled by default. Domain controllers in different sites can replicate transitively if the following conditions are true:

  • They connect to a common site over different site links.

  • Schedules on the two site links overlap. (Replication is available at common times.)

  • A domain controller for the domain is not available in the intervening site.

If you disable this option, you may have to create site link bridges to make it possible for certain domain controllers to communicate.

Additional references

  • User Interface: Active Directory Sites and Services


New Object - Subnet Dialog Box

Item | Details
Prefix | The network address that identifies the range of IP addresses in this subnet.
Prefix name in Active Directory Domain Services | The value that is used for the name of the subnet object in Active Directory Domain Services (AD DS).
Select a site object for this prefix | The site that is associated with the subnet address. When a Domain Name System (DNS) server receives a request for a domain controller in this site, only domain controllers whose IP addresses are in this subnet range are returned. In this way, domain controllers are located according to site.

Additional references

  • User Interface: Active Directory Sites and Services


New Object - Site Link Bridge Dialog Box

Site links are bridged by default, which means that replication automatically follows the route with the least cost between sites. You do not have to bridge site links manually unless you want to make sure that certain routes to a site are never used.

Item | Details
Sites not in this site link bridge | Originally, this list contains no site links because all site links are bridged by default. When you disable site link bridging, this list does not change. When you create the first site link bridge manually, you have to remove sites from the list of bridged site links that you do not want to include in your site link bridge.
Sites in this site link bridge | Originally, this list contains all site links because all site links are bridged by default. When you disable site link bridging, this list does not change. To select the site links that you want to include in your site link bridge, remove site links that you do not want to include in the site link bridge. If you have already implemented a site link bridge, you may have to add one or more site links to the bridge.

Additional references

  • User Interface: Active Directory Sites and Services


Entering Address Prefixes

Subnetting is a set of techniques that you can use to efficiently allocate the address space of one or more unicast address prefixes among the subnets of an organization network.

To determine the subnet prefix of an IP version 4 (IPv4) address configuration in prefix length notation (w.x.y.z/n), retain the n high-order bits, set all the remaining bits to 0, and then convert the result to dotted decimal notation. To determine the subnet prefix of an IPv4 address configuration in subnet mask notation, perform a bit-wise logical AND between the IPv4 address and its subnet mask.

In addition to IPv4 addresses, Windows Server 2008 R2 also supports IP version 6 (IPv6) subnet prefixes. To create a subnet in the IPv6 address space, use either hexadecimal or decimal methods to enumerate the subnet address prefixes.

For more information, see Chapter 4 – Subnetting under TCP/IP Fundamentals for Microsoft Windows (http://go.microsoft.com/fwlink/?LinkId=83553).

Additional references

  • User Interface: Active Directory Sites and Services