I'm having an issue wrapping my head around the myriad Active Directory components, and I'm hoping I can get some opinions or corrections from someone.

At our workplace, we used to have individual active directory domains and sites for each different office location we have. Each location also had a pair of domain controllers that was responsible for that location, and would be used by any stations within that location to manage authentication, GPOs, etc.

Recently, as part of another project, we condensed down all of our domains into our old top level domain. The sites in A/D remained the same, but each individual user account, computer, etc. was moved into the top level domain. Each pair of local DC's was deprecated to just one DC that was a member of the top level domain.

After finishing this, we ran into issues where we were getting -very- slow replication between DCs. The secondary issue of that was individual stations or users seemed to be authenticating against any DC they felt like. On a single station, I found that the user authenticated against one, was receiving DNS from another, and pulling GPOs from somewhere else (I may be mixing this up but you get the idea). It seemed to be essentially random which DC would be contacted by a given station, even though all the DCs were still a member of the proper A/D "sites".

To remedy this problem, we made all the DC's members of the same "top level" site so that replication would essentially be instantaneous. It may sound kind of icky to have that many DCs perpetually replicating to each other, but we run a fairly small setup so there wasn't any major concerns.

My question is, did we go wrong somewhere? I'm currently working on an SCCM install, and only now am I finding out that this is (to put it lightly) not Microsoft's recommended way to do things. My main concerns are:

1) Is this going to bite us later down the road, especially with us being in the midst of trying to set up a stable SCCM install.

2) Can anyone explain why the DC's were getting hit seemingly at random by authentication requests, even though we had them in their corresponding A/D sites (which to the best of my knowledge should give them priority for local requests from stations within the same site).



There is a bit too much to really handle here in a single question.

First, don't start setting up SCCM without getting AD working correctly. Yes, it will bite you later down the road if you don't fix AD first.

Second, Moving your DC's all to the same site is not a good start. Move the DC's back to their respective sites in AD, make sure your subnets are defined and assigned correctly. If you want to manage replicate, take a look at defining specific site connectors to meet your needs. Take a look at fixing the replication issues before doing something drastic (dcdiag/etc to troubleshoot). Make sure your DNS is clean and working. Take a look at your DHCP settings to make sure the proper DNS servers are getting assigned to the workstations. Make sure your DC's are set with the correct DNS servers.

If you want to go beyond this, find a reputable vendor to work with your to get your environment right.

  • Thanks for the answer. So to be clear, was the setup we originally converted to correct? (e.g. Single domain, multiple Sites with DCs assigned to each site) I just want to be clear as to whether the original layout was something that should have worked as it stood. – AtomicReaction Dec 3 '13 at 17:40
  • 2
    Yes. Single domain, multiple sites, and DC's in each site is a very common topology and is usually the first choice I would go for the majority of any single entity company with multiple sites. – Rex Dec 3 '13 at 17:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.