3

I'm having AD replication issues (OUs not replicating, FRS, etc) and suspect the issue is that the network admins have modified AD Sites And Services in ways that disabled the ISTG and other aspects.

Specifically, I see a number of site links, site link bridges, with varying costs that don't make sense, and seem to have been put in place to fix a problem at a point in time. (or perceived problem).

In an ideal scenario, where

  • there are two hub sites
  • 200 spoke sites
  • none of the spoke sites can communicate with each other (with an exception or two)

Question

What is the ideal configuration for AD replication?

What should the ISTG be set on the hub and spokes?

Should the Automatically Generated links be manually deleted?

Improve this question
3

You'll need to disable "Bridge All Site Links" also. With this enabled, KCC assumes the network is fully routable from end-to-end, which is why you are seeing those connection objects.

This blog will probably have all of your answers: AD Site Design and Auto Site Link Bridging, or Bridge All Site Links (BASL)

Improve this answer
1

Leave the ISTG at the default value (if it's been changed, change it back). Delete any manual links and let the KCC reestablish its own topology.

Additional info here, particularly...

The Knowledge Consistency Checker (KCC) creates connection objects automatically, but they can also be created manually. Connection objects created by the KCC appear in the Active Directory Sites and Services snap-in as and are considered adequate under normal operating conditions. Connection objects created by an administrator are manually created connection objects. A manually created connection object is identified by the name assigned by the administrator when it was created. When you modify an connection object, you convert it into an administratively modified connection object and the object appears in the form of a GUID. The KCC does not make changes to manual or modified connection objects.

Improve this answer
2
  • Will the KCC account for unreachable links? I see "automatic" links to unreachable sites. I don't know how "unreachable" is defined. I guess it's possible that ICMP is passing, or some other oddity that I'd have to test for. (Why would KCC recreate unreachable links?) – halfbit May 21 '14 at 13:39
  • Are you sure the sites are unreachable? They must be able to communicate somehow. – Bigbio2002 May 22 '14 at 22:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.