Solved

NTDS Active Directory replication question

Posted on 2011-03-18
11
409 Views
Last Modified: 2012-05-11
hi all,

was just wondering, i just added a new user to dc1 i checked at dc3 and i thought that on new user add it replicates instantly?

i looked the schedule (automatically created one) states it goes every hour, i thought it replicated isntantly on the following events:

account creation
account lockout
account pass change

any others and am i right in thinking this and how can i troublshoot the fact that its not
0
Comment
Question by:awilderbeast
  • 4
  • 3
  • 2
  • +2
11 Comments
 
LVL 11

Assisted Solution

by:Tasmant
Tasmant earned 166 total points
ID: 35164782
depends if your DC are in the same AD site or dispersed over sites.
when in the same site, since windows 2003 replication takes max 30 seconds.
for dispersed domain controllers over site, depends of your replication topology and time you setup.
but the replication is not forced for specific events, replication follow what it is configured for all events.
0
 
LVL 1

Author Comment

by:awilderbeast
ID: 35164815
DC1 and DC3 are at different offices but they are all part of the same domain

ah right so its always an hour(if thats what its set as in the auto generated replication topology) no matter what, even in server 2008?
0
 
LVL 11

Expert Comment

by:Tasmant
ID: 35164884
yes even in server 2008
0
Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

 
LVL 10

Expert Comment

by:Bawer
ID: 35164940
if servers are in the same site, the replication will happen every 15 seconds, if the servers are in different sites, the replication will depend on the time defined by the admin,

what is the current structure?
0
 
LVL 1

Author Comment

by:awilderbeast
ID: 35164951
just to reclarify sites are buildings yes

dc1 is in building 1 and dc3 is in building 3 (connected via vpn)
0
 
LVL 10

Expert Comment

by:Muzafar Momin
ID: 35165209
user AD sites and Service to configure replication time/schedule
0
 
LVL 12

Accepted Solution

by:
Navdeep earned 334 total points
ID: 35165323
Hi,

You may have single domain however different different sites. if you check in active directory sites and services, under site if you see them under different sites, They look like yellow retangular boxes.

Not sure if are referring them as buildings. But if the servers are physically in different building then it may or may not be in different sites. It will be dependent on how they are place in active directory.

For within site replication time is 15 min by default
For across the sites replication time is 180 min by default

both can be configured as per the requirement

you can force replication using replmon, repadmin /syncall or simply going to ad sites and services and right click on site links and selecting replicate now to force replication irrespective of the schedule

Account creation will be replicated using normal schedules

account lockout
account pass change  

    * Replicating a newly locked out account
    * Changing an LSA secret
    * Changing the account lockout policy
    * Changing the domain password policy
    * Changing the password on a machine account

will be immediate irrespective of intersite or intrasite replication because they come under urgent replication kicked by PDC emulator role.
0
 
LVL 1

Author Comment

by:awilderbeast
ID: 35166613
i created a subnet for each site  and put a dc in each one, as per screen

when i look at the default NTDS settings it says replicates once per hour

so lockout and pass change replicate immideatley is it?


ive attached screen below
Capture.PNG
0
 
LVL 12

Assisted Solution

by:Navdeep
Navdeep earned 334 total points
ID: 35166667
Yes as they come under urgent replication
0
 
LVL 12

Expert Comment

by:Navdeep
ID: 35166673
You can test that
0
 
LVL 1

Author Closing Comment

by:awilderbeast
ID: 35166693
thanks
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A safe way to clean winsxs folder from your windows server 2008 R2 editions
In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question