2

I have recently added a new site to my Active Directory domain (single forest, single domain). I have mapped subnets to the sites, and added one DC to the new site with our remaining 4 on the original site.

As part of the configuration of the new site I looked at NTDS Settings to ensure replication was configured correctly, and things look... odd.

I've compiled a list of which servers have replication configured from other servers. I've obscured the names for security reasons but, for background:

  • SERVER-A is our FSMO role holder for all roles.
  • SERVER-B is a virtual instance of a DC.

Both SERVER-A and SERVER-B are Windows Server 2012 Standard.

  • SERVER-C is our previous FSMO role holder which has been relegated to the role of a standard DC, no FSMO roles are held by it. This DC runs Windows Server 2003.
  • SERVER-D has never hosted any FSMO roles. It runs Windows Server 2008.

SERVER-A through SERVER-D all live in the same AD Site, called BHO.

  • SERVER-E holds no FSMO roles but is the sole DC in a new site, called ECO. It runs Windows Server 2012 Standard.

Ultimately, SERVER-C and SERVER-D will be demoted, removed from the domain, and have their hard disks formatted. However, I am nervous to do this because it appears replication relies quite heavily on these servers at present, particularly SERVER-C!

The list below shows each server, and the "source" servers associated with it (i.e. the servers are listed, followed by the servers which appear under the NTDS Settings page in ADS+S.

SERVER-C -> SERVER-A
SERVER-C -> SERVER-B
SERVER-C -> SERVER-E
SERVER-D -> SERVER-A
SERVER-D -> SERVER-B
SERVER-A -> SERVER-C
SERVER-A -> SERVER-D
SERVER-B -> SERVER-C
SERVER-B -> SERVER-D
SERVER-E -> SERVER-A

I am unsure what this means. If I click SERVER-C, go into it's NTDS Settings, and see Servers A, B and E listed, does this mean changes made on servers A, B and E will be replicated to C, or that changes on C are pushed to A, B and E?

My understanding is that C will receive changes from A, B and E which seems strange given that C is our "PDC" (for want of a better description). What I want is for C to push changes to A, B, D and E. And for each of A, B, D, and E to push their changes to C. Even more ideally, C and D would both be master copies, would replicate changes between themselves, but all other servers (A, B, E) would replicate their changes to one of C and D, before the change is then pushed out to the remaining servers.

I hope this explanation makes sense. Please could someone clarify whether I'm barking up the wrong tree and if so, whether it is safe to add the correct NTDS replication settings before removing the "incorrect" ones?

7
  • I've obscured the names for security reasons ... uh, it would be more secure to not expose your domain controllers to the internet, FYI. And if they're not exposed to the internet, obscuring the names does little/nothing for security. – HopelessN00b Oct 14 '14 at 20:27
  • @HopelessN00b They're not exposed to the internet but the hostnames of them might give away the name of the company I work for! – Daniel Arkley Oct 14 '14 at 20:29
  • 2
    Privacy != Security. – HopelessN00b Oct 14 '14 at 20:30
  • Agreed, I'll be more careful to choose appropriate wording next time! Or write a bit earlier in the day... – Daniel Arkley Oct 14 '14 at 21:00
  • 2
    Dude - your LinkedIn gives away the company you work for. – mfinni Oct 14 '14 at 21:06
4

Very short answer: Unless you have really, really oddball connectivity (connections with time-limited availability, connections with excessively high bandwidth costs that warrant tuning replication traffic) you really don't need to manually adjust anything about Active Directory (AD) replication. It just works (rather well, actually).

Microsoft has background material about how AD replication works that I'd recommend you review to get details.

The basic overview of the replication model within sites (intrasite) is:

  • Although AD replication is pull-based, Domain Controllers (DCs) send Change Notifications to their replication partners within a site informing them when changes are available.

  • The replication partner verifies that it does not have newer data than what the source server DC (because, potentially, it could have already received this or a newer update from another DC).

  • The replication partner requests updates from the source DC it determines that its local replicas of the object are in need of update.

Replication between sites doesn't use change notifications (by default) but, rather, at a configurable interval (as low as 15 minutes) a DC will poll its replication partner in the remote site to obtain changes. You can enable the change notification mechanism over intersite links to permit replication to occur in intervals shorter than 15 minutes.

Also, be aware that there, at minimum, three different replication topologies in play in a single domain AD forest. Each partition of the AD database is replicated on a potentially different topology.

  • Schema
  • Domain
  • Global Catalog

In Windows Server 2003 AD Forests you will also have a ForestDNSZones partition, and a ForestDNSZones partition for each domain in the forest.

The repadmin tool from the Windows Support Tools can be used to build some rudimentary visualizations of the AD replication topology.

6
  • Thanks for the explanation Evan. Is it safe to say if I removed SERVER-C and SERVER-D, AD would automatically reconfigure itself to make A, B and E replicate to each other? – Daniel Arkley Oct 14 '14 at 20:52
  • 3
    The KCC and ISTG, respectively, will handle generating the intra-site and inter-site replication topology. You can check the current state of replication by running repadmin /showrepl from a command prompt on a DC. When you demote your same site DC's the KCC will generate/adjust the replication topology as needed. IMO, it's preferred to let the KCC and ISTG do their jobs and not manually configure the replication topology unless you have a specific need to do so. – joeqwerty Oct 14 '14 at 20:53
  • Yes Daniel, if you DEMOTE (properly, not turn off and unplug) SERVER-C and D, then yes ADS&S will handle everything just fine automatically. – TheCleaner Oct 14 '14 at 20:54
  • I don't have the privilege to upvote, but if I did I would. Thanks for your answers and comments, all! – Daniel Arkley Oct 14 '14 at 21:02
  • 1
    @mfinni - Thanks for the suggestion to the OP... >smile< ewwhite is uncomfortably close now, so I need all the help I can get. – Evan Anderson Oct 14 '14 at 21:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.