2

I have two AD sites: Hub and Spoke.

ISTG is turned off for both of them, and a new DC is being placed in to the site with no ISTG enabled.

What is the correct order of operations to set up manual one-way NTDS connections?

e.g.

  • If I set Sites & Services focus to a DC the spoke site, what NTDS connections should I add where? Should I add the connection to the "spoke" site visible in Sites and Services? Or should I add the connection to the hub site while focus is set on this DC?

Conversely

  • If I set Sites & Services focus to a DC the HUB site, what NTDS connections should I add where? Should I add the connection to the "spoke" site visible in Sites and Services? Or should I add the connection to the hub site, while focus is set on this DC?

My thought is, if I do this incorrectly one of two situations will occur:

  • Each side will "know" of each other, but won't initiate the push, because they expect the push server to do it. (hint: the push server doesn't know to push the updates, because it's not configured to do so)

  • If I just create bi-directional connections, then I may have wasted time and cause weirdness in AD. e.g. If I create one in hub and spoke site in "AD Sites and Services" , and do the same action when setting focus to each side 4 connections will be made. Not sure what will happen...

Improve this question
4
  • The larger question is why do you have the ISTG disabled in these sites?
    – MDMarra
    Jul 16, 2014 at 1:51
  • It's a non-mesh network, spokes can't talk to other spokes. @mdmarra
    – makerofthings7
    Jul 16, 2014 at 2:31
  • 1
    That's no reason to disable the ISTG... You want to disable "Bridge all site links" but leave automatic topology generation enabled.
    – MDMarra
    Jul 16, 2014 at 2:32
  • Also, just as an aside, all AD replication is pull-based. Nothing is pushed. DCs with changes will use change notification within a site and if configured, it will also use it between sites, but the notification of changes doesn't constitute a push of data. Replication changed are pulled by the notified DCs or on a schedule as is the default behavior for inter-site replication.
    – MDMarra
    Jul 16, 2014 at 16:07

1 Answer 1

Reset to default
3

A better option is to not disable the ISTG at all and let the KCC do it's thing within the confines that you define within Active Directory Sites and Services. Based on your comments above, you have no reason to disable the ISTG. This is what I would recommend.

  1. Disable the "Bridge All Site Links" option in Sites and Services. This will prevent two individual site links from automatically being treated as transitive. Since your spokes cannot communicate, this is important.

  2. Create one site link for each branch and the hub if you haven't already. For example, if you have branch sites in AD Sites and Services named "Boston" and "Philadelphia" and a hub site named "HQ" you should have two site links: One named something like "Boston-HQ" that contains only those two sites and a second site link named "Philadelphia-HQ" that contains only those two sites. Since site link bridging is disabled, Philadelphia will not attempt to communicate with Boston. Never include two spokes that cannot communucate in the same site link.

  3. Re-enable the ISTG wherever you have disabled it.

  4. Delete any manually created replication connections that you have made.

  5. Run repadmin /kcc on each DC to force automatic replication connection generation.

Creating manual site links and stopping the KCC from performing its important functions is rarely necessary and it doesn't sound like you have a compelling case to be doing this. Automatic replication connection generation is greatly preferred from both a management and availability perspective. If you re-evaluate your current design, your actual question becomes irrelevant.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .