Are multiple sites needed for a single Active DIrectory domain and single forest?

Posted on 2008-02-12
Medium Priority
Last Modified: 2010-03-17
Hello Experts,
I'm wondering if there are any advantages or disadvantages for creating multiple sites for an AD enviornment with one single forest and one single domain.  Our domain is expected to grow to about 10,000 users, and our network enviornment consists of a city-wide campus between several different buildings, all of which are on the same network but different subnets.

We have setup multiple domain controllers within the various subnets to balance load, but would you recommend creating multiple sites and multiple global catalog servers as well?  What's the best architecture for a seemingly flat, but large AD enviornment?

Question by:esckeyrwm
  • 2

Accepted Solution

QBRad earned 150 total points
ID: 20876258
I would set them up in one forest / domain but make them different sites so that you can control replication between the different sites.  I would make each building a separate subnet / site.  Then i would put a DC at each site and make it a global catalog for redundancy.  If the links between sites go down you will be able to authenticate your users locally from the local dc / global cat server.  Make sure the users in each building are set to authenticate with the dc at that site.  I've seen setups where the users are all going to another site to login and authenticate, completely bypassing their local dc.
LVL 31

Assisted Solution

by:Toni Uranjek
Toni Uranjek earned 150 total points
ID: 20876489

Site and site links design depends on  physical locations and WAN links between locations.Main benefeit of using sites in configurable replication traffic between and localizatoin of authentication traffic. For second one you will have to create IP subnet objects and associate themwith site objects. Each site has to contain at least one DC fora each domain and one global caatalog. In single domain forest each domain controller should also be global catalog. If you will have five sites, you will need also five domain controllers.



Author Comment

ID: 20877930
QBRad & Toni,

Thank you both for your advice.  Seems like setting up multiple sites is the way to go for a large geographic location.  Part of the reason why we've kept it a single-site enviornment is because we weren't sure what kind of impact a multi-site enviornment would have on replication.  We offer a lot of "on-demand" services (from user account creation, to GPO updates, to password resets) and we can't afford replication to take longer then a matter of minutes.  By creating a mulit-site enviornment, am I running the risk of a 15-minute minimum on replication?  I understand there is a bandwidth cost of replicating at a more frequent interval.  

Thanks again.
LVL 31

Expert Comment

by:Toni Uranjek
ID: 20878133
When you set replication frequency to once in 15 minutes, this is maximum interval. AD will be replicated at least once in 15 minutes.

Featured Post

Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

High user turnover can cause old/redundant user data to consume valuable space. UserResourceCleanup was developed to address this by automatically deleting user folders when the user account is deleted.
It’s time for spooky stories and consuming way too much sugar, including the many treats we’ve whipped for you in the world of tech. Check it out!
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

619 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question