Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I work at an organization with 15 physical sites. The corporate headquarters has two DC's, which hold all the FSMO roles between them. Each remote site has one DC onsite.

When I started working here, AD sites were not configured. My question is, what is gained by configuring them if we have high speed WAN links between all sites (over 10 MB.) I am aware that login speed could improve. But, when the WAN link is down, clients should still be able to find the local DC, correct?

share|improve this question
1  
Are you sure that you have 10 mbps between any two sites? You also need to consider net available bandwidth and latency. 10 mbps doesnt help much if the connection is near capacity or delay is > nnn ms. –  Greg Askew May 13 '13 at 22:17

3 Answers 3

10 Mb is not fast. Go ahead and set up sites. A number of manageability improvements will follow. Sites are associated with subnets, and I assume you already have separate subnets for each site as you imply that they are all associated with one WAN. If so, the implementation of sites is not time-consuming.

share|improve this answer

It's quite possible to have an Active Directory architecture configured across multiple physical locations in a single site. It's generally not a "good thing" and goes against most best practice.

If you ever want to control/configure/optimize your replication traffic, you'll have to setup sites. If you ever want to do branch cache in a reasonable way, you'll need to setup sites. If you want to do DFS replication and local folder targeting, you'll probably need to define the sites. If you want to ensure the best user logon experience, you'll need to define the sites. If you want to push printers by site using GPO/GPP, you'll probably want to define the sites.

The list could go on. So, the technical answer is, no - you don't have to. The real answer is that you really do want to define them as sites so you can leverage Active Directory to provide the services it is designed to provide in the best possible way.

Edit: To specifically answer the question on if they would still be able to authenticate on a link failure: yes, provided they have the local DC as one if their DNS servers. However, their authentication for anything might be slower depending on which DC got initially cached.

share|improve this answer
1  
+1 - Not to mention multi-site Exchange deployments. It's just good practice to set up ADS&S with your sites and subnets, whether or not you think you need them. –  joeqwerty May 13 '13 at 19:57

There are a lot of things that use Sites and Services besides just the logon process and DC-to-DC replication traffic.

  • Exchange uses it for global catalog location

  • DFS-N uses it for referral target ordering

  • DFS-R uses it for replication partner selection

  • You can leverage site-based GPOs

If you don't want to wait the minimum 15 minutes for replication between sites, just enable change notification across your site links. You should absolutely still set up sites, though.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.