3

I've noticed that our Windows Clients from remote sites cause a lot of SMB traffic to our primary domain controller at our main site.

Every location has its own domain controller and "Active Directory Sites and Services" is also correctly configured so that each subnet is assigned to the correct site.

When I do an "set logon" it also displays the correct domain controller. Also "nltest /dsgetdc:ourdomain" shows the correct domain controller. "Normal" requests also go to the correct DC.

But when I run Wireshark, I can see that many SMB requests belong to the file called "samr", which means that we are talking Remote Procedure Calls using the SAMR protocol.

Is there any way to tell the clients that they should use the local domain controller instead of the PDC?

This causes up to 1.7 GB per client and week. This doesn't seem to be much, but if we're talking about a lot of clients, the adds a lot of background noise which may not be neccessarry.

Wireshark Screenshot

Improve this question

1 Answer 1

Reset to default
3

SAMR is an old protocol that isn't used for much. It isn't used to read from SYSVOL or Group Policies.

It is used for changing computer passwords, and for other things such as some WMI classes use SAMR and prefer to use the PDC emulator.

One WMI class is Win32_UserAccount. This may be used directly by you, or in a script by other products such as config management. It has a defect that causes query of the PDC for domain accounts when attempting to query local accounts.

There could be others.

On an endpoint, you may be able to confirm by enabling WMI logging. In Application and Service logs, Microsoft > Windows > WMI. Right click and select to enable diagnostics logging.

The Win32_UserAccount class can be configured to query the local computer by using a where clause and specifying the local host.

SELECT * FROM Win32_UserAccount WHERE DOMAIN=%COMPUTERNAME%

https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-useraccount

Improve this answer
2
  • There's a GPO for that: "Network access: Restrict clients allowed to make remote calls to SAM". So basically it should be safe to add the Domain-Users group to the deny list and link it to the affected DC?
    – HellstormDe
    Commented Aug 27 at 8:53
  • @HellstormDe: no, that will not prevent the call from being made.
    – Greg Askew
    Commented Aug 27 at 10:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .