2

I have two AD sites: Hub and Spoke.

ISTG is turned off for both of them, and a new DC is being placed in to the site with no ISTG enabled.

What is the correct order of operations to set up manual one-way NTDS connections?

e.g.

  • If I set Sites & Services focus to a DC the spoke site, what NTDS connections should I add where? Should I add the connection to the "spoke" site visible in Sites and Services? Or should I add the connection to the hub site while focus is set on this DC?

Conversely

  • If I set Sites & Services focus to a DC the HUB site, what NTDS connections should I add where? Should I add the connection to the "spoke" site visible in Sites and Services? Or should I add the connection to the hub site, while focus is set on this DC?

My thought is, if I do this incorrectly one of two situations will occur:

  • Each side will "know" of each other, but won't initiate the push, because they expect the push server to do it. (hint: the push server doesn't know to push the updates, because it's not configured to do so)

  • If I just create bi-directional connections, then I may have wasted time and cause weirdness in AD. e.g. If I create one in hub and spoke site in "AD Sites and Services" , and do the same action when setting focus to each side 4 connections will be made. Not sure what will happen...

  • The larger question is why do you have the ISTG disabled in these sites? – MDMarra Jul 16 '14 at 1:51
  • It's a non-mesh network, spokes can't talk to other spokes. @mdmarra – halfbit Jul 16 '14 at 2:31
  • 1
    That's no reason to disable the ISTG... You want to disable "Bridge all site links" but leave automatic topology generation enabled. – MDMarra Jul 16 '14 at 2:32
  • Also, just as an aside, all AD replication is pull-based. Nothing is pushed. DCs with changes will use change notification within a site and if configured, it will also use it between sites, but the notification of changes doesn't constitute a push of data. Replication changed are pulled by the notified DCs or on a schedule as is the default behavior for inter-site replication. – MDMarra Jul 16 '14 at 16:07
3

A better option is to not disable the ISTG at all and let the KCC do it's thing within the confines that you define within Active Directory Sites and Services. Based on your comments above, you have no reason to disable the ISTG. This is what I would recommend.

  1. Disable the "Bridge All Site Links" option in Sites and Services. This will prevent two individual site links from automatically being treated as transitive. Since your spokes cannot communicate, this is important.

  2. Create one site link for each branch and the hub if you haven't already. For example, if you have branch sites in AD Sites and Services named "Boston" and "Philadelphia" and a hub site named "HQ" you should have two site links: One named something like "Boston-HQ" that contains only those two sites and a second site link named "Philadelphia-HQ" that contains only those two sites. Since site link bridging is disabled, Philadelphia will not attempt to communicate with Boston. Never include two spokes that cannot communucate in the same site link.

  3. Re-enable the ISTG wherever you have disabled it.

  4. Delete any manually created replication connections that you have made.

  5. Run repadmin /kcc on each DC to force automatic replication connection generation.

Creating manual site links and stopping the KCC from performing its important functions is rarely necessary and it doesn't sound like you have a compelling case to be doing this. Automatic replication connection generation is greatly preferred from both a management and availability perspective. If you re-evaluate your current design, your actual question becomes irrelevant.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.