I'm having an issue wrapping my head around the myriad Active Directory components, and I'm hoping I can get some opinions or corrections from someone.
At our workplace, we used to have individual active directory domains and sites for each different office location we have. Each location also had a pair of domain controllers that was responsible for that location, and would be used by any stations within that location to manage authentication, GPOs, etc.
Recently, as part of another project, we condensed down all of our domains into our old top level domain. The sites in A/D remained the same, but each individual user account, computer, etc. was moved into the top level domain. Each pair of local DC's was deprecated to just one DC that was a member of the top level domain.
After finishing this, we ran into issues where we were getting -very- slow replication between DCs. The secondary issue of that was individual stations or users seemed to be authenticating against any DC they felt like. On a single station, I found that the user authenticated against one, was receiving DNS from another, and pulling GPOs from somewhere else (I may be mixing this up but you get the idea). It seemed to be essentially random which DC would be contacted by a given station, even though all the DCs were still a member of the proper A/D "sites".
To remedy this problem, we made all the DC's members of the same "top level" site so that replication would essentially be instantaneous. It may sound kind of icky to have that many DCs perpetually replicating to each other, but we run a fairly small setup so there wasn't any major concerns.
My question is, did we go wrong somewhere? I'm currently working on an SCCM install, and only now am I finding out that this is (to put it lightly) not Microsoft's recommended way to do things. My main concerns are:
1) Is this going to bite us later down the road, especially with us being in the midst of trying to set up a stable SCCM install.
2) Can anyone explain why the DC's were getting hit seemingly at random by authentication requests, even though we had them in their corresponding A/D sites (which to the best of my knowledge should give them priority for local requests from stations within the same site).