Lesson 6: Configuring Active Directory Replication

Active Directory directory services automatically configure a default topology to enable replication within a domain. For a network that includes multiple locations, however, you must customize the replication topology to minimize the impact of replication traffic on the network.

To configure Active Directory replication, you need to map your physical network to Active Directory directory services by creating sites and site links. A site is a combination of one or more Internet Protocol (IP) subnets that are connected by a high-speed link. A site link is a connection between two or more sites.

When you create a site link, you specify values that reflect information about available connections, preferred connection times, and available bandwidth. Active Directory directory services use this information to determine the times and connections for replication that will afford the best performance for your network.

In a Windows NT 4.0 network, replication is single master. All changes to a domain are made on the primary domain controller. The changes are then replicated directly to the backup domain controllers in the domain. In a Windows NT 4.0 network, the only way to control the flow of replication traffic is by creating multiple domains in different physical locations.

In Windows 2000, however, all domain controllers are peers, and replication is multimaster. As a result, you can make changes to a domain on any domain controller, and those changes replicate to every other domain controller in the domain. In a Windows 2000 network, you can control the flow of replication traffic by configuring sites and site links that map your network's physical structure to Active Directory directory services.

Within a site, Windows 2000 automatically configures replication, though you can modify the configuration to optimize replication. Between sites, however, you must configure replication manually.

When you install Active Directory directory services, the Active Directory Installation wizard creates a default topology that accommodates replication for a single location with high-speed connectivity. However, if your network includes multiple locations, Active Directory replication will not be optimized for your network structure.

Figure 4.12 demonstrates how the default replication topology requires a change on a domain controller in Atlanta to replicate across the slow wide area network (WAN) link four times to update every domain controller in the domain.

Figure 4.12 Default replication topology

To optimize replication traffic, you need to customize the default replication topology by mapping the physical structure of your network to Active Directory directory services.

Figure 4.13 demonstrates how the customized replication topology enables a change on a domain controller in Atlanta to replicate to all domain controllers in Atlanta and cross the slow WAN link only a single time before replicating to all domain controllers in Mexico City.

Figure 4.13 Customized replication topology

In Windows 2000, you define a network model of sites and site links within Active Directory directory services to control the flow of replication traffic. Based on the model you define, Active Directory directory services create connections that enable replication. If any connection in the replication topology fails, Active Directory directory services modify the remaining connections to maintain replication within the network.

Figure 4.14 provides examples of site link placement in three basic network models.

Figure 4.14 Three basic network models

In example 1 in Figure 4.14, routers connect multiple sites, and the cost of traffic among the sites in the example is not uniform. For example, the cost associated with sending traffic from A to B is not the same as the cost associated with sending traffic from A to C. As a result, you must create a site link to define each WAN connection. The relative cost of each connection depends on the speed of that connection.

For example, if site link AB models a network connection of 128 Kbps and site link BC models a network connection of 256 Kbps, the cost of site link AB will be twice as much as the cost of site link BC.

In example 2 in Figure 4.14, a switch connects multiple sites. Because the cost of traffic flowing from one site to any other site in the example is the same, you can create a site link that defines the connection between all four sites. While you must assign a cost to the site link, the value you assign is arbitrary unless you intend to create another site link in the network.

In example 3 in Figure 4.14, a switch connects multiple sites, including a remote site. The connection speed to the remote site is different from the connection speed to the other sites in the model, and therefore has a different cost.

Example 3 includes two site links:

• One site link defines the connection between the sites that are using similar bandwidths.
• One site link defines the connection between the switch area and the remote site. The cost of connecting to the remote site (D) is the same for each of the sites in the switch area, so any of the sites (A, B, or C) can be part of the site link.

After you assess a cost for each WAN connection, you map your physical network to Active Directory directory services by configuring sites and then configuring site links to define the connections between those sites.

Configuring a site involves creating a site and configuring a subnet in Active Directory directory services. Subnets define the IP address ranges that exist within a site. When you configure a subnet, you must associate it with a site.

When you create a site, you must associate it with a site link. Before you configure the site links that map the connectivity in your network, you must specify the default site link, DEFAULTIPSITELINK.

You create sites in Active Directory directory services to optimize replication traffic and to enable users to connect to a domain controller by using a reliable, high-speed connection. To create and configure a site, use the Active Directory Sites and Services snap-in. Right-click Sites, click New, and then click Site. You must provide a site name, and select a site link.

A subnet in Active Directory directory services provides the link between IP addresses and sites. You can only associate a subnet with one site; however, you can associate a site with multiple subnets. When you configure a subnet in Active Directory directory services, you must specify the network/bit-masked identifier for the subnet. The network/bit-masked identifier includes the subnet ID for the subnet and the number of bits masked by the subnet mask.

For example, if your subnet ID is 10.14.208.0 and your subnet mask is 255.255.240.0, to determine that the network/bit-masked identifier would be 10.14.208.0/20, do the following steps.

Note that the subnet mask is represented by four decimal numbers separated by a period. Each number can be referred to as an octet, which means it can be represented by 8 binary digits (bits). To calculate the number of bits masked, you could do the following:

1. Start Calculator, and on the View menu of Calculator, select Scientific.

Scientific mode of Calculator allows you to convert decimal numbers to binary, which will allow you to calculate the number of bits.

2. Make sure the Dec radio button is selected.

This sets Calculator in decimal mode, which means any numbers entered will be understood as decimal.

3. Enter the first octet of your subnet mask into Calculator.

If your subnet mask was 255.255.248.0, the first octet is 255. The first octet is always on the left.

4. Click the Bin radio button.

The number you now see is the binary representation of the decimal number you entered first. Notice that there are eight 1 bits.

5. Click the Dec radio button to change Calculator back to decimal mode.
6. Continue entering the second, third, and fourth octet into Calculator and converting them to binary. Record the number of 1 bits in the table below. Add the numbers in the second column and record the total.

Octet	Number of 1 bits
1st	8
2nd	8
3rd	4
4th	0
Total	20

The total is the number of bits masked by your subnet mask.

7. Close Calculator.

To configure a subnet in Active Directory directory services, use Active Directory Sites and Services. Expand Sites to see Subnets. When you select New Subnet, you must provide the network/bit-masked identifier and a site with which to associate this subnet.

After you configure the sites for your network, you create site links in Active Directory directory services to map the connections between the sites. For each site link, you need to specify the following properties to define the connections in your network:

• Cost. By default, the cost of a site link is 100.
• Replication interval. The replication interval defines the frequency of replication. By default, replication occurs every three hours.
• Schedule. The schedule declares the time periods during which the link is available. For instance, you might make a site link representing a dial-up line unavailable during business hours when phone rates are high. By default, replication can occur at all times.

To create a site link, open Active Directory Sites and Services, expand Sites, and then expand Inter-Site Transports. Right-click IP or SMTP, depending on which transport protocol you want the site link to use, and click New Site Link. In the Name box, type the name for the site link. Click two or more sites to include in this site link, and then click Add.

After you configure the sites and site links for your network, Active Directory directory services directs the flow of replication traffic accordingly.

After you configure Active Directory replication for your network, you configure a global catalog server for each site in your network to accomplish the following goals:

• Improving the performance of forestwide queries, by providing a partial list of attributes for every object in Active Directory directory services
• Reducing the time required for user logon, by ensuring that logon traffic remains within that site
• Enhancing the reliability of user logon, by ensuring that there are multiple global catalog servers to complete user logon

To configure a domain controller as a global catalog server, use Active Directory Sites and Services. In the console tree, right-click NTDS Settings, click Properties, and on the General tab, select the Global Catalog Server check box.